fastify: fastify: Request spoofing via numeric trustProxy configuration (CVE-2026-16732)

Overview

A flaw was found in fastify. When configured with a numeric trustProxy value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, and can lead to secure-cookie and Cross-Site Request Forgery (CSRF) origin bypasses, as well as host-based routing and cache poisoning.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift Dev Spaces · updated 2026-09-24 · vex

fastify: fastify: Request spoofing via numeric trustProxy configuration — rated Moderate by Red Hat. Released 2026-08-18, updated 2026-09-24.

Affected:

• Red Hat OpenShift Dev Spaces

No fix planned:

• Red Hat OpenShift Dev Spaces

Not affected:

• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)

Remediation

Fix deferred

Workarounds / mitigations:

• To mitigate this issue, configure the trustProxy setting in fastify to use an IP address, CIDR range, or a custom function that explicitly validates the connecting address. Additionally, ensure that the Fastify origin is only accessible through the trusted proxy chain and not directly exposed to untrusted networks. Consult the fastify documentation for specific configuration details. Reloading or restarting the affected service may be required for changes to take effect.

Package advisory (CVE-2026-16732)

Affected packages:

• fastify >= 5.8.3, < 5.12.1

Patched in:

• fastify 5.12.1

Source: https://github.com/advisories/GHSA-3m5p-2c4r-xxw2