{"schemaVersion":3,"id":"CVE-2026-3635","aliases":["GHSA-444r-cwp2-x5xf"],"status":"published","duplicateOf":null,"title":null,"description":"Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify <= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.","dates":{"published":"2026-03-23T13:53:00.386Z","modified":"2026-03-23T15:30:10.526Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","exploitability":4.1,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00168,"percentile":0.0578,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.048000000000000015,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0012},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00168,"percentile":0.0578}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0012,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00168,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00168,"percentile":0.0578}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-348","name":"Use of Less Trusted Source","description":"The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/348.html"}],"affected":[{"vendor":"fastify","product":"fastify","name":"fastify","label":"fastify","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.8.2","noFixRecorded":false,"fixedIn":null},{"text":"< 5.8.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.8.2 | < 5.8.3","eol":null,"hubHref":"/vendor/fastify/fastify"},{"vendor":"Npm","product":"fastify","name":"fastify","label":"fastify","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/fastify","purlType":"npm","versions":[{"text":"< 5.8.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.8.3","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf","label":"github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf","hostname":"github.com","tags":["WEB","Vendor Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3635","label":"www.cve.org/CVERecord?id=CVE-2026-3635","hostname":"www.cve.org","tags":["WEB","Third Party Advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","label":"cna.openjsf.org/security-advisories.html","hostname":"cna.openjsf.org","tags":["WEB","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3635","label":"nvd.nist.gov/vuln/detail/CVE-2026-3635","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/fastify/fastify","label":"github.com/fastify/fastify","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.8.3","label":"github.com/fastify/fastify/releases/tag/v5.8.3","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-03-23T13:53:00.386Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-23T15:30:10.526Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:44:59.463Z","stale":false,"partial":false}}