CVE-2026-3635: Fastify Authentication Bypass Vulnerability

CVE-2026-3635 Overview

CVE-2026-3635 is a header spoofing vulnerability in the Fastify web framework that affects versions 5.8.2 and earlier. When trustProxy is configured with a restrictive trust function (such as a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters incorrectly read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.

Critical Impact

Applications using request.protocol or request.host for security decisions such as HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, and host-based routing are vulnerable when trustProxy is configured with restrictive trust functions.

Affected Products

• Fastify versions <= 5.8.2

Discovery Timeline

• 2026-03-23 - CVE-2026-3635 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3635

Vulnerability Analysis

This vulnerability (CWE-348: Use of Less Trusted Source) stems from improper validation of forwarded headers in Fastify's request handling logic. The core issue lies in how Fastify processes the X-Forwarded-Proto and X-Forwarded-Host headers when restrictive trust proxy configurations are in place.

When trustProxy: true is configured, Fastify is expected to trust all forwarded headers from any source — this is documented behavior. However, when administrators configure more restrictive trust settings (specific IPs, subnets, hop counts, or custom validation functions), they expect only connections from trusted proxies to have their forwarded headers honored.

The vulnerability manifests because the request.protocol and request.host getters do not properly enforce these restrictive trust configurations. An attacker who can connect directly to the Fastify server (bypassing legitimate proxy infrastructure) can inject malicious X-Forwarded-Proto and X-Forwarded-Host headers that the application will incorrectly trust.

This can lead to several security impacts including HTTPS downgrade attacks where applications believe they are operating over HTTP when actually over HTTPS (or vice versa), host header injection enabling cache poisoning or password reset poisoning, CSRF protection bypasses through origin/host validation failures, and incorrect URL generation in security-sensitive contexts.

Root Cause

The root cause is insufficient validation in Fastify's request property getters. When evaluating whether to trust forwarded headers, the code path for request.protocol and request.host does not properly consult the configured trust proxy restrictions before reading header values. This creates a disconnect between the administrator's intended security posture (trusting only specific proxies) and the actual behavior (trusting headers from any source).

Attack Vector

The attack requires adjacent network access, meaning the attacker must be able to establish a direct TCP connection to the Fastify server, bypassing any legitimate reverse proxy infrastructure. In many deployment scenarios, this could occur when the Fastify application is exposed on an internal network, in containerized environments with misconfigured network policies, or in cloud deployments where internal load balancer traffic is not properly isolated.

The attacker would craft HTTP requests containing malicious X-Forwarded-Proto and X-Forwarded-Host headers. For example, an attacker could set X-Forwarded-Proto: https on an HTTP connection to bypass HTTPS enforcement checks, or manipulate X-Forwarded-Host to perform host header attacks.

For technical details and proof-of-concept examples, see the GitHub Security Advisory GHSA-444r-cwp2-x5xf.

Detection Methods for CVE-2026-3635

Indicators of Compromise

• Unexpected X-Forwarded-Proto or X-Forwarded-Host headers in application logs from non-proxy IP addresses
• Authentication or CSRF validation failures correlated with unusual header patterns
• Security monitoring alerts for connections bypassing expected proxy infrastructure
• Application behavior inconsistencies related to protocol or host detection

Detection Strategies

• Implement network-level monitoring to detect direct connections to Fastify servers that should only receive traffic through reverse proxies
• Enable detailed request logging including all forwarded headers and client IP addresses for forensic analysis
• Deploy web application firewall (WAF) rules to flag or block requests with suspicious forwarded headers from untrusted sources

Monitoring Recommendations

• Audit current trustProxy configurations across all Fastify deployments to identify affected instances
• Monitor for anomalous traffic patterns where internal services receive direct external connections
• Review application security decisions that rely on request.protocol or request.host values

How to Mitigate CVE-2026-3635

Immediate Actions Required

• Upgrade Fastify to a patched version when available (versions > 5.8.2)
• Review and validate all network configurations to ensure Fastify servers only accept connections from trusted proxy infrastructure
• Implement network-level controls (firewalls, security groups) to prevent direct access to Fastify applications from untrusted networks
• Audit application code for security-critical usage of request.protocol and request.host

Patch Information

Affected organizations should monitor the OpenJS Foundation Security Advisories and GitHub Security Advisory for official patch releases. The vulnerability affects Fastify versions <= 5.8.2.

Workarounds

• Configure network infrastructure to ensure Fastify servers are not directly accessible from untrusted networks
• Use trustProxy: false and implement custom header validation logic if protocol/host detection is not required
• Deploy a reverse proxy or load balancer that strips and rewrites forwarded headers before passing traffic to Fastify
• Implement application-level validation that cross-references forwarded header values against known trusted values

# Network-level mitigation: Restrict Fastify server access using iptables
# Allow connections only from trusted proxy IP (e.g., 10.0.0.1)
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP