GHSA-444r-cwp2-x5xf
Medium · 6.1CVSS
6.1
EPSS
—
Published
Mar 25, 2026
CISA due date
—
The record
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | fastify | 0 | 5.8.3 |
Related vulnerabilities
- CVE-2026-3635 Summary When trustProxy is configured with a restrictive trust function (e.g., a specific… Same vulnerability
- GHSA-247c-9743-5963 Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header Also affects fastify
- CVE-2026-33806 Impact: Fastify applications using schema.body.content for per-content-type body… Also affects fastify
- CVE-2026-3419 Fastify incorrectly accepts malformed `Content-Type` headers containing trailing… Also affects fastify
- GHSA-573f-x89g-hqp9 Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass… Also affects fastify
- CVE-2026-25224 Fastify is a fast and low overhead web framework, for Node.js. Also affects fastify
- CVE-2026-25223 Fastify is a fast and low overhead web framework, for Node.js. Also affects fastify
- GHSA-mrq3-vjjr-p77c Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream Also affects fastify