{"id":"CVE-2026-3635","aliases":["CLSA-2026-1786387037","CLSA-2026-1789159896","CLSA-2026-1789906142","EUVD-2026-14431","GHSA-444r-cwp2-x5xf"],"status":"published","title":"Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function","description":"Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify \u003c= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00153,"percentile":0.04466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-348"],"published":"2026-03-23T13:53:00Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"npm","package":"fastify","fixed_in":["5.8.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fastify","fixed_in":["4.29.1-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.8.2"},{"fixed":"5.8.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.29.1-tuxcare.0"},{"fixed":"4.29.1-tuxcare.2"}]}],"versions":["4.29.1","4.29.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.4-tuxcare.0"},{"fixed":"5.7.4-tuxcare.1"}]}],"versions":["5.7.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.1"}]}],"versions":["5.2.1"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"fastify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.8.3"}]}]}],"products":[{"vendor":"@clerk","product":"fastify"},{"vendor":"fastify","product":"fastify"}],"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf","tags":["Vendor Advisory","advisory","web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3635","tags":["Third Party Advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3635","tags":["advisory"]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.8.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-444r-cwp2-x5xf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3635.json","tags":["advisory"]},{"url":"https://github.com/fastify/fastify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-3635","title":"Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function","description":"Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify \u003c= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","status":"published","published":"2026-03-23T13:53:00.386Z","modified":"2026-03-23T15:30:10.526Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-14431","description":"Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify \u003c= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","status":"published","published":"2026-03-23T13:53:00Z","modified":"2026-03-23T15:30:10Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:31.168902Z"}],"ghsa":[{"id":"GHSA-444r-cwp2-x5xf","title":"fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections","description":"## Summary\n\nWhen `trustProxy` is configured with a restrictive trust function (e.g., a specific IP like `trustProxy: '10.0.0.1'`, a subnet, a hop count, or a custom function), the `request.protocol` and `request.host` getters read `X-Forwarded-Proto` and `X-Forwarded-Host` headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\n## Affected Versions\n\nfastify \u003c= 5.8.2\n\n## Impact\n\nApplications using `request.protocol` or `request.host` for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when `trustProxy` is configured with a restrictive trust function.\n\nWhen `trustProxy: true` (trust everything), both `host` and `protocol` trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","status":"published","published":"2026-03-25T19:32:28Z","modified":"2026-03-25T19:32:29Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T14:39:42.712607Z"}],"nvd":[{"id":"CVE-2026-3635","description":"Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify \u003c= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","status":"published","published":"2026-03-23T14:16:34.72Z","modified":"2026-06-17T10:43:54.143Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T14:12:10.568062Z"}],"osv":[{"id":"CVE-2026-3635","title":"Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function","description":"Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify \u003c= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","status":"published","published":"2026-03-23T13:53:00.386Z","modified":"2026-10-28T02:31:01.125690328Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-444r-cwp2-x5xf","title":"fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections","description":"## Summary\n\nWhen `trustProxy` is configured with a restrictive trust function (e.g., a specific IP like `trustProxy: '10.0.0.1'`, a subnet, a hop count, or a custom function), the `request.protocol` and `request.host` getters read `X-Forwarded-Proto` and `X-Forwarded-Host` headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\n## Affected Versions\n\nfastify \u003c= 5.8.2\n\n## Impact\n\nApplications using `request.protocol` or `request.host` for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when `trustProxy` is configured with a restrictive trust function.\n\nWhen `trustProxy: true` (trust everything), both `host` and `protocol` trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","status":"published","published":"2026-03-25T19:32:28Z","modified":"2026-03-25T19:56:21.10811Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-348"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"CLSA-2026-1786387037","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.2.","status":"published","published":"2026-08-10T18:37:17Z","modified":"2026-10-15T09:45:59.900297505Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1789159896","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.7.4-tuxcare.1.","status":"published","published":"2026-09-11T20:51:36Z","modified":"2026-10-15T09:48:03.816200884Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789906142","title":"TuxCare security update for fastify (3 CVEs)","description":"TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.1.","status":"published","published":"2026-09-20T12:09:02Z","modified":"2026-10-15T09:46:02.760386369Z","updated_at":"2026-11-02T15:43:48.28229Z"}]}}