{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*",
            "extracted_events": [
              {
                "introduced": "5.8.3"
              },
              {
                "fixed": "5.12.1"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "CPE_RANGE"
            ]
          },
          "events": [
            {
              "introduced": "a3e77ce171516e95f0c28ce60b9e5228a4c42fe4"
            },
            {
              "fixed": "7d196a998c422062a3aaa3f8041db91ad576cea0"
            }
          ],
          "repo": "https://github.com/fastify/fastify",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-3m5p-2c4r-xxw2"
  ],
  "database_specific": {
    "cna_assigner": "openjs",
    "cwe_ids": [
      "CWE-348"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16732.json"
  },
  "details": "fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly, because those forms compile to predicates that inspect the connecting address. The hop-count form, where trustProxy is set to a number, compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as trustProxy set to 1 for a single reverse proxy, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact class matches the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. Affected versions are fastify from 5.8.3 up to but not including 5.12.1. Patches: patched in fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. Workarounds: migrate to an IP, CIDR, or custom-function trustProxy value that validates the connecting address, and ensure the Fastify origin is only reachable through the trusted proxy chain.",
  "id": "CVE-2026-16732",
  "modified": "2026-09-04T03:30:32.843946843Z",
  "published": "2026-08-18T20:30:22.592Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16732.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16732"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count"
}