CVE-2026-16732

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly, because those forms compile to predicates that inspect the connecting address. The hop-count form, where trustProxy is set to a number, compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as trustProxy set to 1 for a single reverse proxy, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact class matches the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. Affected versions are fastify from 5.8.3 up to but not including 5.12.1. Patches: patched in fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. Workarounds: migrate to an IP, CIDR, or custom-function trustProxy value that validates the connecting address, and ensure the Fastify origin is only reachable through the trusted proxy chain.

• CWE-348

• https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
• https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2Mitigation, Vendor Advisory

Published

Aug 18, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16727Concurrent Execution using Shared Resource with Improper Syn…7.3
• CVE-2026-16728undici's retry interceptor can deliver a response whose body…6.5
• CVE-2026-16729undici's setCookie function does not fully sanitize cookie a…6.5
• CVE-2026-1673The BEAR – Bulk Editor and Products Manager Professional for…4.3
• CVE-2026-16730A flaw was found in dbus-broker. When the process file-descr…5.5
• CVE-2026-16731OMICRON StationScout before version 3.05 contains a cryptogr…8.3
• CVE-2026-16733A weakness has been identified in bahmutov find-cypress-spec…5.3
• CVE-2026-16734The Stripe Payment Forms by WP Full Pay WordPress plugin be…7.5
• CVE-2026-16735A security vulnerability has been detected in release-it con…5.3
• CVE-2026-16736The User Registration & Membership WordPress plugin before …7.5
• CVE-2026-16737The WP Travel Engine WordPress plugin before 6.8.5 does not…5.3
• CVE-2026-16738The Conekta Payment Gateway WordPress plugin before 6.2.2 do…5.3