CVE-2026-18174: Fastify Forwarded Information Disclosure

CVE-2026-18174 Overview

CVE-2026-18174 affects @fastify/forwarded, a Node.js module that resolves client addresses from the X-Forwarded-For HTTP header. Versions before 3.0.2 trim only space characters between comma-separated entries, ignoring horizontal tab characters that RFC 7230 defines as optional whitespace. An entry padded with a tab retains the literal tab byte in the resolved address string. This weakness (classified as improper input validation, CWE-20) allows attackers to bypass exact string match security controls that rely on the resolved client IP address.

Critical Impact
Attackers can evade IP-based allowlists, blocklists, per-IP rate limits, and audit log correlation by injecting a tab character into the X-Forwarded-For header entry.

Affected Products

@fastify/forwarded versions prior to 3.0.2
Fastify applications consuming the module for client IP resolution
Downstream middleware performing exact-match IP allowlist, blocklist, or rate-limit lookups

Discovery Timeline

2026-07-29 - CVE CVE-2026-18174 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18174

Vulnerability Analysis

The @fastify/forwarded package parses the X-Forwarded-For header to derive the originating client IP address behind trusted proxies. When the header contains two or more comma-separated entries, the parser removes leading and trailing space characters from each entry. RFC 7230 defines optional whitespace (OWS) as either the space character or the horizontal tab character. The parser omits the tab from its trim set. An entry such as 192.0.2.1,\t192.0.2.99 produces a resolved address containing a literal tab byte prefix.

Applications that make security decisions based on exact string equality against the resolved IP treat the tab-corrupted string as a distinct value. A blocklist entry for 192.0.2.99 no longer matches \t192.0.2.99. A per-IP rate limit key becomes a separate bucket. Audit log correlation queries miss related events. The impact is confined to string comparison logic; the corrupted output is not a valid IP and cannot impersonate a trusted proxy address, so the trust boundary between proxy and client is preserved.

Root Cause

The parser implementation uses a whitespace trim routine that considers only the ASCII space character (0x20) rather than the full OWS set defined by RFC 7230, which includes horizontal tab (0x09). This deviation from the specification permits tab bytes to survive parsing and appear in the returned address string.

Attack Vector

An attacker sends an HTTP request through a trusted proxy chain with a crafted X-Forwarded-For header containing tab-padded entries. The vulnerability requires no authentication and no user interaction. Any downstream security control that performs exact string matching on the parsed client IP is subject to bypass.

See the GitHub Security Advisory GHSA-2849-m2w7-xm8f for advisory details.

Detection Methods for CVE-2026-18174

Indicators of Compromise

Requests containing X-Forwarded-For header values with embedded horizontal tab characters (0x09) adjacent to comma separators
Application logs recording client IP fields that begin or end with non-printable whitespace bytes
Rate-limit or audit stores containing keys that visually resemble known IPs but fail exact equality checks

Detection Strategies

Inspect HTTP access logs and reverse-proxy telemetry for X-Forwarded-For values containing tab characters between comma-separated entries
Add regex-based detection at the WAF or ingress layer to flag X-Forwarded-For values matching ,\t sequences
Compare resolved client IP strings against a canonical IP regex and alert when the value fails validation

Monitoring Recommendations

Correlate rate-limit key cardinality growth with anomalous X-Forwarded-For header patterns
Monitor for repeated near-duplicate entries in blocklist or allowlist lookup failures
Alert on any deployed Node.js service loading @fastify/forwarded at versions below 3.0.2

How to Mitigate CVE-2026-18174

Immediate Actions Required

Upgrade @fastify/forwarded to version 3.0.2 or later across all Node.js services
Audit dependency trees with npm ls @fastify/forwarded to locate transitive installations
Review application code that performs exact string comparison against client IPs and add explicit IP validation

Patch Information

The issue is fixed in @fastify/forwarded3.0.2. The patch expands whitespace trimming to include the horizontal tab character in line with RFC 7230 optional whitespace rules. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-2849-m2w7-xm8f for release details.

Workarounds

Strip or reject X-Forwarded-For header values containing non-space whitespace at the reverse proxy or WAF layer before the request reaches the application
Normalize resolved client IP strings by trimming all whitespace and validating against an IPv4 or IPv6 regex prior to security decisions
Configure trusted proxies to overwrite rather than append to X-Forwarded-For, removing attacker-controlled entries from the header

bash

# Upgrade the vulnerable dependency
npm install @fastify/forwarded@^3.0.2
npm ls @fastify/forwarded