CVE-2026-16732: Fastify Auth Bypass Vulnerability

CVE-2026-16732 Overview

CVE-2026-16732 affects Fastify, a low-overhead web framework for Node.js. The vulnerability is an incomplete fix for CVE-2026-3635. The prior patch added a guard that inspected the connecting address before honoring forwarded headers. That guard works for IP, CIDR, and custom-function trustProxy configurations. It does not work for the numeric hop-count form. When trustProxy is set to a number such as 1, the compiled predicate ignores the connecting address entirely. An attacker who reaches the Fastify origin directly, bypassing the front-facing proxy, can spoof forwarded request fields.

Critical Impact
Attackers can spoof host, protocol, ip, and ips values on Fastify origins configured with numeric trustProxy, enabling host injection, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and cache poisoning.

Affected Products

Fastify versions from 5.8.3 up to but not including 5.12.1
Node.js applications using numeric trustProxy configuration (for example, trustProxy: 1)
Deployments where the Fastify origin is reachable outside the trusted proxy chain

Discovery Timeline

2026-08-18 - CVE-2026-16732 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-16732

Vulnerability Analysis

CVE-2026-16732 is an authentication-of-source bypass classified as [CWE-348] Use of Less Trusted Source. Fastify derives request metadata such as host, protocol, hostname, ip, and ips from forwarded headers like X-Forwarded-For and X-Forwarded-Host. Trusting these headers requires verifying that the connecting peer is a legitimate reverse proxy.

The fix for the parent issue CVE-2026-3635 introduced a predicate that validates the connecting address before honoring forwarded fields. Fastify supports several forms of trustProxy: boolean, IP string, CIDR range, custom function, and numeric hop count. The numeric form is intended to indicate how many proxy hops to skip when parsing X-Forwarded-For. The compiled predicate for this form structurally ignores the connecting address and returns true whenever the hop count is one or greater.

Because the guard is always satisfied, forwarded headers are honored on every request regardless of source. The impact class matches the parent CVE and enables host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, host-based routing manipulation, and cache poisoning.

Root Cause

The proxyaddr integration in Fastify compiles numeric trustProxy values into a trust function that counts hops without checking the immediate peer. The security guard added for CVE-2026-3635 assumed all trust predicates evaluated the connecting address. That assumption does not hold for the hop-count form.

Attack Vector

An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, sends a crafted request containing forged X-Forwarded-Host, X-Forwarded-Proto, or X-Forwarded-For headers. Fastify treats the spoofed values as authoritative, corrupting downstream logic that relies on request.host, request.protocol, or request.ip. Exploitation requires network reachability to the origin outside the trusted proxy path, which aligns with the Adjacent Network attack vector.

See the GitHub Security Advisory GHSA-3m5p-2c4r-xxw2 for maintainer technical details.

Detection Methods for CVE-2026-16732

Indicators of Compromise

Inbound requests to the Fastify origin sourced from addresses outside the documented reverse-proxy CIDR range
Requests containing X-Forwarded-Host or X-Forwarded-Proto headers arriving from non-proxy peers
Application logs showing request.host or request.protocol values that disagree with the terminating load balancer
Unexpected secure-cookie issuance, cache-key variance, or redirect targets tied to attacker-controlled host values

Detection Strategies

Inventory all Fastify services and identify any using a numeric trustProxy value such as trustProxy: 1
Compare the source IP of inbound TCP connections against the approved proxy allowlist and alert on deviations
Audit application code paths that consume request.host, request.hostname, request.protocol, request.ip, or request.ips for security-sensitive decisions

Monitoring Recommendations

Log the connecting peer address alongside forwarded header values for every request and flag mismatches
Monitor egress firewall and security-group rules to confirm the Fastify origin is not directly reachable from untrusted networks
Track deployment manifests and configuration files for the string trustProxy with numeric assignments

How to Mitigate CVE-2026-16732

Immediate Actions Required

Upgrade Fastify to version 5.12.1 or later, which disables the numeric form of trustProxy at runtime and removes it from the TypeScript type union
Replace numeric trustProxy values with an explicit IP address, CIDR range, or custom function that validates the connecting address
Restrict network access so the Fastify origin is only reachable through the trusted proxy chain using security groups, firewalls, or private networking

Patch Information

The issue is fixed in Fastify 5.12.1. The patch disables the numeric hop-count form of trustProxy at runtime and removes it from the TypeScript type definitions. Applications that previously passed a number must update their configuration to a supported form before upgrading. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-3m5p-2c4r-xxw2 for release notes.

Workarounds

Migrate trustProxy to a specific IP string, such as trustProxy: '10.0.0.1', matching the reverse-proxy address
Migrate trustProxy to a CIDR range that covers only the reverse-proxy fleet, such as trustProxy: '10.0.0.0/24'
Supply a custom function that inspects the connecting address and returns a boolean based on an allowlist
Enforce network-level isolation so the origin cannot receive traffic outside the proxy chain, removing the attacker's ability to reach the vulnerable code path

bash

# Configuration example: replace numeric trustProxy with an explicit allowlist
# Vulnerable configuration
# const app = fastify({ trustProxy: 1 })

# Safe configuration using CIDR
# const app = fastify({ trustProxy: '10.0.0.0/24' })

# Safe configuration using custom function
# const app = fastify({
#   trustProxy: (addr) => ['10.0.0.10', '10.0.0.11'].includes(addr)
# })