{"id":"CVE-2026-16732","title":"fastify: fastify: Request spoofing via numeric trustProxy configuration (CVE-2026-16732)","summary":"A flaw was found in fastify. When configured with a numeric `trustProxy` value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for hos…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-501","CWE-348"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","affected":["openshift_dev_spaces"],"patched":["fastify 5.12.1"],"published":"2026-08-18","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:53:59+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16732.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16732.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-16732"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518255"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16732"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16732"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2"},{"url":"https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280"},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.1"},{"url":"https://github.com/advisories/GHSA-3m5p-2c4r-xxw2"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00158,"epssPercentile":0.04877,"aliases":["GHSA-3m5p-2c4r-xxw2"],"ecosystem":"npm","ingestedAt":"2026-09-02T15:46:29.491Z","slug":"CVE-2026-16732","body":"## Overview\n\nA flaw was found in fastify. When configured with a numeric `trustProxy` value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, and can lead to secure-cookie and Cross-Site Request Forgery (CSRF) origin bypasses, as well as host-based routing and cache poisoning.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift Dev Spaces · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16732.json)\n\n**fastify: fastify: Request spoofing via numeric trustProxy configuration** — rated Moderate by Red Hat. Released 2026-08-18, updated 2026-09-24.\n\nAffected:\n\n- Red Hat OpenShift Dev Spaces\n\nNo fix planned:\n\n- Red Hat OpenShift Dev Spaces\n\nNot affected:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, configure the `trustProxy` setting in fastify to use an IP address, CIDR range, or a custom function that explicitly validates the connecting address. Additionally, ensure that the Fastify origin is only accessible through the trusted proxy chain and not directly exposed to untrusted networks. Consult the fastify documentation for specific configuration details. Reloading or restarting the affected service may be required for changes to take effect.\n\n## Package advisory (CVE-2026-16732)\n\nAffected packages:\n\n- `fastify >= 5.8.3, < 5.12.1`\n\nPatched in:\n\n- `fastify 5.12.1`\n\nSource: https://github.com/advisories/GHSA-3m5p-2c4r-xxw2","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}