Use of Less Trusted Source in Fastify - CVE-2026-16732
Published: August 19, 2026
Vulnerability identifier: #VU144299
CSH Severity: Medium
CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-16732
CWE-ID: CWE-348
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of less trusted source in X-Forwarded-* handling for request.host, request.protocol, request.hostname, request.ip, and request.ips when processing requests with trustProxy configured as a hop count. A remote attacker can send a specially crafted request directly to the Fastify origin with spoofed X-Forwarded-* headers to disclose sensitive information.
Exploitation requires direct network reachability to the Fastify origin while the application is configured with the numeric trustProxy form.
Affected software
Fastify
How to mitigate CVE-2026-16732
Install security update from vendor's website.
Fastify - update to 5.12.1