FKIE_CVE-2026-3635

Vulnerability from fkie_nvd - Published: 2026-03-23 14:16 - Updated: 2026-04-16 17:46
Severity ?
6.1 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Summary
Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application. Affected Versions fastify <= 5.8.2 Impact Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function. When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.
References
ce714d77-add3-4f53-aff5-83d477b104bbhttps://cna.openjsf.org/security-advisories.htmlThird Party Advisory
ce714d77-add3-4f53-aff5-83d477b104bbhttps://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xfVendor Advisory
ce714d77-add3-4f53-aff5-83d477b104bbhttps://www.cve.org/CVERecord?id=CVE-2026-3635Third Party Advisory
Impacted products
Vendor Product Version
fastify fastify *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "27A424F7-D048-4767-9071-5C4D0A85FDFA",
              "versionEndExcluding": "5.8.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: \u002710.0.0.1\u0027, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify \u003c= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations."
    },
    {
      "lang": "es",
      "value": "Resumen\nCuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva (por ejemplo, una IP espec\u00edfica como `trustProxy: \u002710.0.0.1\u0027`, una subred, un recuento de saltos o una funci\u00f3n personalizada), los *getters* `request.protocol` y `request.host` leen los encabezados `X-Forwarded-Proto` y `X-Forwarded-Host` de cualquier conexi\u00f3n, incluidas las conexiones de IPs no confiables. Esto permite a un atacante que se conecta directamente a Fastify (salt\u00e1ndose el proxy) suplantar tanto el protocolo como el *host* vistos por la aplicaci\u00f3n.\n\nVersiones Afectadas\nfastify \u0026lt;= 5.8.2\n\nImpacto\nLas aplicaciones que utilizan `request.protocol` o `request.host` para decisiones de seguridad (aplicaci\u00f3n de HTTPS, *flags* de cookie seguras, comprobaciones de origen CSRF, construcci\u00f3n de URL, enrutamiento basado en *host*) se ven afectadas cuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva.\n\nCuando `trustProxy: true` (confiar en todo), tanto el *host* como el protocolo conf\u00edan en todos los encabezados reenviados \u2014 este es el comportamiento esperado. La vulnerabilidad solo se manifiesta con configuraciones de confianza restrictivas."
    }
  ],
  "id": "CVE-2026-3635",
  "lastModified": "2026-04-16T17:46:58.897",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.0,
        "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-23T14:16:34.720",
  "references": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf"
    },
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3635"
    }
  ],
  "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-348"
        }
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.