CVE-2026-75021: fastify-cli Node.js Inspector RCE Vulnerability

CVE-2026-75021 Overview

CVE-2026-75021 is a high-severity vulnerability in fastify-cli that exposes the Node.js Inspector to remote networks. When a developer starts the CLI with a debug flag, fastify-cli ignores the explicit bind address supplied and binds the Inspector to a broadly reachable interface instead of loopback. The Inspector protocol permits arbitrary code evaluation, so any remote party who reaches the port can execute code on the developer's machine. The flaw affects fastify-cli versions 1.5.0 through 8.0.1 and is tracked under [CWE-1327]. Users must upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

Critical Impact

Remote attackers who can reach the Inspector port gain arbitrary code execution on the developer's machine with the developer's privileges.

Affected Products

• fastify-cli versions 1.5.0 through 8.0.1
• Node.js development environments using fastify-cli with debug flags
• Developer workstations exposing the Inspector on non-loopback interfaces

Discovery Timeline

• 2026-09-08 - CVE-2026-75021 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75021

Vulnerability Analysis

The vulnerability sits in how fastify-cli launches the underlying Node.js process when a debug flag is passed. The CLI accepts an explicit Inspector bind address from the user but discards it during process spawn. Instead of binding to the requested loopback interface, the Inspector attaches to a broadly reachable address. This exposes the Chrome DevTools Protocol endpoint to any host that can route to the developer's machine.

The Node.js Inspector protocol is not an authenticated debugging channel. Any client that connects can call Runtime.evaluate and execute arbitrary JavaScript inside the target process. Because the process runs with the developer's user context, an attacker gains code execution equivalent to the logged-in user. Local file access, credential theft from environment variables, and pivoting into corporate networks all follow directly from Inspector access.

The issue is classified as [CWE-1327]: Binding to an Unrestricted IP Address. Exploitation requires the target to be running fastify-cli in debug mode and the attacker to reach the Inspector port, which explains the high attack complexity rating.

Root Cause

The root cause is that fastify-cli overrides or ignores the --inspect=<host>:<port> bind address supplied by the user. Node.js itself supports binding the Inspector to 127.0.0.1 to restrict access to loopback, but fastify-cli did not propagate that host component when constructing the child process arguments. The Inspector therefore fell back to a broader listening interface, defeating the developer's security intent.

Attack Vector

An attacker on the same network segment, a shared developer VLAN, or any routable path to the workstation can connect to the exposed Inspector port. After identifying the WebSocket debugger URL via the Inspector's HTTP metadata endpoint, the attacker issues Chrome DevTools Protocol commands such as Runtime.evaluate to run arbitrary JavaScript. Coffee-shop Wi-Fi, cloud development VMs with public IPs, and CI runners are realistic exposure scenarios. The vulnerability manifests during process startup; see the GitHub Security Advisory GHSA-88v4-3ph7-r88m for the maintainer's technical description.

Detection Methods for CVE-2026-75021

Indicators of Compromise

• Unexpected inbound TCP connections to Node.js Inspector ports (default 9229) on developer workstations
• HTTP GET /json or GET /json/version requests to Node.js processes from non-loopback sources
• WebSocket upgrade requests to /devtools/page/ or /devtools/browser/ endpoints on developer machines
• Child processes spawned by node such as sh, bash, powershell.exe, or cmd.exe shortly after Inspector activity

Detection Strategies

• Inventory workstations running fastify-cli versions prior to 8.0.1 using package manifests and npm ls fastify-cli
• Monitor for Node.js processes listening on non-loopback interfaces with the --inspect flag active
• Alert on outbound connections from node processes to attacker-controlled destinations following Inspector contact
• Correlate Inspector protocol traffic with process ancestry to identify unexpected Runtime.evaluate usage

Monitoring Recommendations

• Enable endpoint process telemetry that records command-line arguments for all node and fastify invocations
• Log network flows from developer subnets and flag any external access to ports 9229 through 9299
• Track file-system writes and credential file reads initiated by node processes running with debug flags
• Feed developer workstation telemetry into a central data lake for retroactive hunting against Inspector abuse patterns

How to Mitigate CVE-2026-75021

Immediate Actions Required

• Upgrade fastify-cli to version 8.0.1 across all developer workstations, container images, and CI pipelines
• Audit any long-running developer sessions started with --inspect and terminate processes bound to non-loopback interfaces
• Restrict developer workstation exposure by blocking inbound traffic to ports 9229 through 9299 at host and network firewalls
• Rotate any secrets that may have been present in the environment variables or memory of exposed Node.js processes

Patch Information

The maintainers released fastify-cli 8.0.1, which honors the configured Inspector bind address. Install the fix with npm install fastify-cli@8.0.1 or the equivalent command for yarn or pnpm. Reference the GitHub Security Advisory GHSA-88v4-3ph7-r88m and the OpenJS Foundation Security Advisories for the maintainer's guidance.

Workarounds

• Avoid using debug flags with vulnerable fastify-cli versions on any network other than an isolated loopback-only host
• Enforce a host firewall rule that permits Inspector ports only from 127.0.0.1
• Run fastify-cli inside a container or VM with no bridged network interface when debugging is required
• Invoke node --inspect=127.0.0.1:9229 directly against the application entry point instead of through the vulnerable CLI wrapper

# Configuration example
npm install fastify-cli@8.0.1

# Verify the installed version
npm ls fastify-cli

# Host firewall rule (Linux) restricting Inspector ports to loopback
sudo iptables -A INPUT -p tcp --dport 9229:9299 ! -i lo -j DROP