CVE-2026-3635

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3635", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-03-06T09:16:35.081Z", "datePublished": "2026-03-23T13:53:00.386Z", "dateUpdated": "2026-03-23T15:30:10.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-23T13:53:00.386Z"}, "title": "Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-348", "description": "CWE-348 Use of less trusted source", "type": "CWE"}]}], "affected": [{"vendor": "fastify", "product": "fastify", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "5.8.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.8.3", "versionType": "semver"}], "defaultStatus": "unaffected", "packageURL": "pkg:npm/fastify"}], "descriptions": [{"lang": "en", "value": "Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify <= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><b>Summary</b><br>When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.<br><br><b>Affected Versions<br></b>fastify &lt;= 5.8.2<br><br><b>Impact<br></b>Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.<br><br>When trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.</p>"}]}], "references": [{"url": "https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-3635"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "LetaoZhao (TinkAnet)", "type": "reporter"}, {"lang": "en", "value": "KaKa (climba03003)", "type": "remediation reviewer"}, {"lang": "en", "value": "Matteo Collina", "type": "remediation reviewer"}, {"lang": "en", "value": "Ulises Gasc\u00f3n", "type": "remediation reviewer"}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:29:15.532885Z", "id": "CVE-2026-3635", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:30:10.526Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3635", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:29:15.532885Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:29:59.578Z"}}], "cna": {"title": "Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "LetaoZhao (TinkAnet)"}, {"lang": "en", "type": "remediation reviewer", "value": "KaKa (climba03003)"}, {"lang": "en", "type": "remediation reviewer", "value": "Matteo Collina"}, {"lang": "en", "type": "remediation reviewer", "value": "Ulises Gasc\u00f3n"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "fastify", "product": "fastify", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.8.2"}, {"status": "unaffected", "version": "5.8.3", "versionType": "semver"}], "packageURL": "pkg:npm/fastify", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-3635"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "descriptions": [{"lang": "en", "value": "Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify <= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.", "supportingMedia": [{"type": "text/html", "value": "<p><b>Summary</b><br>When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.<br><br><b>Affected Versions<br></b>fastify &lt;= 5.8.2<br><br><b>Impact<br></b>Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.<br><br>When trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-348", "description": "CWE-348 Use of less trusted source"}]}], "providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-23T13:53:00.386Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3635", "state": "PUBLISHED", "dateUpdated": "2026-03-23T15:30:10.526Z", "dateReserved": "2026-03-06T09:16:35.081Z", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "datePublished": "2026-03-23T13:53:00.386Z", "assignerShortName": "openjs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/fastify", "product": "fastify", "vendor": "fastify", "versions": [{"lessThanOrEqual": "5.8.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.8.3", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "27A424F7-D048-4767-9071-5C4D0A85FDFA", "versionEndExcluding": "5.8.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify <= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations."}, {"lang": "es", "value": "Resumen\nCuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva (por ejemplo, una IP espec\u00edfica como `trustProxy: '10.0.0.1'`, una subred, un recuento de saltos o una funci\u00f3n personalizada), los *getters* `request.protocol` y `request.host` leen los encabezados `X-Forwarded-Proto` y `X-Forwarded-Host` de cualquier conexi\u00f3n, incluidas las conexiones de IPs no confiables. Esto permite a un atacante que se conecta directamente a Fastify (salt\u00e1ndose el proxy) suplantar tanto el protocolo como el *host* vistos por la aplicaci\u00f3n.\n\nVersiones Afectadas\nfastify &lt;= 5.8.2\n\nImpacto\nLas aplicaciones que utilizan `request.protocol` o `request.host` para decisiones de seguridad (aplicaci\u00f3n de HTTPS, *flags* de cookie seguras, comprobaciones de origen CSRF, construcci\u00f3n de URL, enrutamiento basado en *host*) se ven afectadas cuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva.\n\nCuando `trustProxy: true` (confiar en todo), tanto el *host* como el protocolo conf\u00edan en todos los encabezados reenviados \u2014 este es el comportamiento esperado. La vulnerabilidad solo se manifiesta con configuraciones de confianza restrictivas."}], "id": "CVE-2026-3635", "lastModified": "2026-06-17T10:43:54.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.0, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3635", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:29:15.532885Z", "version": "2.0.3"}}]}, "published": "2026-03-23T14:16:34.720", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Third Party Advisory"], "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-3635"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-348"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "fastify: request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function", "id": "2450330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450330"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-348", "details": ["A flaw was found in fastify. When the trustProxy option is configured with a restrictive trust function, such as a specific IP, a subnet, a hop count or a custom function, the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection, including connections from untrusted IPs. This allows an attacker connecting directly to the server, bypassing the proxy, to spoof both the protocol and host seen by the application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-3635", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-dashboard-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-dashboard-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-gen-ai-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-maas-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-model-registry-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/dashboard-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-03-23T13:53:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3635\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3635\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf"], "statement": "This vulnerability is only exploitable by applications using the trustProxy option with a restrictive trust function and only when the request.protocol or request.host getters are used for security decisions, such as HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction or host-based routing. Also, to exploit this issue, an attacker needs to bypass the proxy entirely and connect directly to the Fastify application port, limiting the exposure of this flaw. Due to these reasons, this vulnerability has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.8.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.8.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fastify", "source": "cna", "vendor": "fastify"}, "product": "fastify", "vendor": "fastify"}], "analysis": {"en": {"generated_at": "2026-03-23T15:22:54.411150+00:00", "value": {"mitigation_remediation": ["Upgrade Fastify to version 5.8.3 or later to patch the flaw.", "If upgrading is not immediately possible, modify trustProxy to either be true (trust all), or ensure it is configured only for IP addresses that are truly behind a trusted reverse proxy.", "Verify that forwarded headers are only accepted from validated upstream proxies; remove or filter X-Forwarded-Proto and X-Forwarded-Host headers from untrusted connections.", "Review application logic that relies on request.protocol or request.host for security decisions and adjust to use stricter origin validation or scheme checks directly against the server configuration."], "summary": {"action": "Immediate Patch", "impact": "Spoofing of request protocol and host can allow attackers to bypass HTTPS enforcement, set incorrect cookie flags, and bypass CSRF checks."}, "threat_synthesis": {"affected_systems": "Fastify versions 5.8.2 and earlier are affected. The advisory specifically lists fastify <= 5.8.2 as vulnerable.", "description_and_impact": "When Fastify\u2019s trustProxy setting is configured with a restrictive trust function, the framework still allows any incoming connection to supply X-Forwarded-Proto and X-Forwarded-Host headers. An attacker who connects directly to the Fastify server, without going through a trusted proxy, can therefore instruct the application to believe it is being accessed over HTTPS or via a different host. This manipulation can break security controls that rely on request.protocol and request.host, enabling misissued secure cookies, incorrect URL generation, flawed host-based routing, and potential CSRF bypasses. The underlying weakness is an improper extraction of forwarded headers in the presence of a sanitized trust proxy function.", "risk_and_exploitability": "The CVSS v3 base score is 6.1, indicating a medium severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is an attacker directly connecting to the Fastify application over an untrusted network and sending malicious X-Forwarded-Proto and X-Forwarded-Host headers, which the framework will accept under the described configuration. The vulnerability requires the attacker to have network connectivity to the server, but no privileged access or code execution is necessary. While the likelihood of automated exploitation is uncertain, the configuration error is simple enough that a determined attacker could exploit it manually."}}}}, "created": "2026-03-24T10:33:51.998184+00:00", "updated": "2026-03-25T21:28:08.439657+00:00", "vendors": ["fastify", "fastify$PRODUCT$fastify"]}