CVE-2026-75021

The record

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

Affected packages

Related vulnerabilities

• CVE-2026-20212 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could… CWE-1327
• CVE-2026-72924 GitHub CLI (gh) is GitHub's official command line tool. CWE-1327
• CVE-2026-16713 IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote… CWE-1327
• CVE-2026-16503 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that… CWE-1327
• CVE-2026-55641 9Router is an AI router & token saver. CWE-1327
• CVE-2026-0481 Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could… CWE-1327
• CVE-2026-42503 gopls by default communicates via pipe. CWE-1327
• GHSA-525j-hqq2-66r4 OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 CWE-1327