CVE-2026-16732 is a medium-severity (CVSS 6.1) CWE-348 vulnerability in fastify. A fix is available for fastify — see the affected versions and patch details below.
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-16732.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-16732 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 391,411 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
fastifynpmDescription
fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly, because those forms compile to predicates that inspect the connecting address. The hop-count form, where trustProxy is set to a number, compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as trustProxy set to 1 for a single reverse proxy, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact class matches the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. Affected versions are fastify from 5.8.3 up to but not including 5.12.1. Patches: patched in fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. Workarounds: migrate to an IP, CIDR, or custom-function trustProxy value that validates the connecting address, and ensure the Fastify origin is only reachable through the trusted proxy chain.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | fastify | ≥ 5.8.3&&< 5.12.1 | 5.12.1npm install fastify@5.12.1 |
Affected Products
fastifyfastifyDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fastify, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update fastify to 5.12.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-16732 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This flaw in fastify allows request spoofing when the `trustProxy` configuration uses a numeric value and an attacker can directly access the Fastify origin, bypassing the front-facing proxy. This can lead to host injection in generated URLs, HTTPS-enforcement bypass, and secure-cookie/CSRF-origin bypass. Red Hat…
To mitigate this issue, configure the `trustProxy` setting in fastify to use an IP address, CIDR range, or a custom function that explicitly validates the connecting address. Additionally, ensure that the Fastify origin is only accessible through the trusted proxy chain and not directly exposed to untrusted networks. Consult the fastify documentation for specific configuration details. Reloading or restarting the affected service may be required for changes to take effect.Source: Red Hat security advisory for CVE-2026-16732 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-16732 in your dependencies?
Find it across npm, including transitive dependencies.