---
id: CVE-2026-16732
title: >-
  fastify: fastify: Request spoofing via numeric trustProxy configuration
  (CVE-2026-16732)
summary: >-
  A flaw was found in fastify. When configured with a numeric `trustProxy`
  value, an attacker who can directly access the Fastify origin, bypassing the
  front-facing proxy, can spoof forwarded request fields. This vulnerability
  allows for hos…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-501
  - CWE-348
vendor: Red Hat
product: Red Hat OpenShift Dev Spaces
affected:
  - openshift_dev_spaces
patched:
  - fastify 5.12.1
published: '2026-08-18'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:53:59+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16732.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16732.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-16732'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2518255'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-16732'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16732'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2'
  - url: >-
      https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280
  - url: 'https://github.com/fastify/fastify/releases/tag/v5.12.1'
  - url: 'https://github.com/advisories/GHSA-3m5p-2c4r-xxw2'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00158
epssPercentile: 0.04877
aliases:
  - GHSA-3m5p-2c4r-xxw2
ecosystem: npm
ingestedAt: '2026-09-02T15:46:29.491Z'
---

## Overview

A flaw was found in fastify. When configured with a numeric `trustProxy` value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, and can lead to secure-cookie and Cross-Site Request Forgery (CSRF) origin bypasses, as well as host-based routing and cache poisoning.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift Dev Spaces · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16732.json)

**fastify: fastify: Request spoofing via numeric trustProxy configuration** — rated Moderate by Red Hat. Released 2026-08-18, updated 2026-09-24.

Affected:

- Red Hat OpenShift Dev Spaces

No fix planned:

- Red Hat OpenShift Dev Spaces

Not affected:

- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

Workarounds / mitigations:

- To mitigate this issue, configure the `trustProxy` setting in fastify to use an IP address, CIDR range, or a custom function that explicitly validates the connecting address. Additionally, ensure that the Fastify origin is only accessible through the trusted proxy chain and not directly exposed to untrusted networks. Consult the fastify documentation for specific configuration details. Reloading or restarting the affected service may be required for changes to take effect.

## Package advisory (CVE-2026-16732)

Affected packages:

- `fastify >= 5.8.3, < 5.12.1`

Patched in:

- `fastify 5.12.1`

Source: https://github.com/advisories/GHSA-3m5p-2c4r-xxw2