Reliance on Untrusted Inputs in a Security Decision Affecting fastify package, versions >=5.8.3 <5.12.1

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the getTrustProxyFn hop-count handling in lib/request.js when trustProxy is configured as a number. An attacker can overwrite request.ip, request.ips, request.host, request.hostname, and request.protocol by sending forged forwarded headers to an origin that is reachable directly, bypassing the front-facing proxy. This lets the attacker make the application treat an arbitrary client address and host as trusted, which can break host-based routing, generate poisoned absolute URLs, bypass HTTPS and secure-cookie checks, and skew cache or CSRF-origin decisions.

Workarounds

• Migrate to an IP/CIDR string, IP/CIDR array, or custom-function trustProxy value that validates the connecting address; custom functions should inspect the address argument, not only the hop index. This prevents direct clients from spoofing X-Forwarded-* values through numeric hop-count trust.
• Ensure the Fastify origin is only reachable through the trusted proxy chain, with no direct network path to the origin. This blocks attackers from bypassing the front-facing proxy and supplying forged forwarded headers.

• GitHub Commit
• Maintainer's Advisory