SB2026081961 - Multiple vulnerabilities in Fastify

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-18504)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass application-enforced limits and disclose sensitive information.

The vulnerability exists due to improper input validation in root-level primitive body schema handling when processing crafted JSON request bodies with default type coercion enabled. A remote user can send a specially crafted request to bypass application-enforced limits and disclose sensitive information.

Only routes that use a root-level primitive body schema with default type coercion are affected. Object and array body schemas are not affected, and user interaction is not required.

2) Use of Less Trusted Source (CVE-ID: CVE-2026-16732)

CWE-ID: CWE-348 - Use of Less Trusted Source

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of less trusted source in X-Forwarded-* handling for request.host, request.protocol, request.hostname, request.ip, and request.ips when processing requests with trustProxy configured as a hop count. A remote attacker can send a specially crafted request directly to the Fastify origin with spoofed X-Forwarded-* headers to disclose sensitive information.

Exploitation requires direct network reachability to the Fastify origin while the application is configured with the numeric trustProxy form.

Remediation

Install update from vendor's website.

References

• https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2