CVE-2026-16732

Executive Summary

CVE-2026-16732 is an incomplete-patch vulnerability in the Fastify web framework for Node.js, affecting versions 5.8.3 through 5.12.0. The flaw allows an attacker who can reach the Fastify origin directly (bypassing a front-facing reverse proxy) to spoof forwarded request fields — including host, protocol, hostname, IP, and IPs — when the application is configured with a numeric trustProxy value. This reopens the impact class of the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. The fix was released in Fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. This vulnerability is notable as it demonstrates a common security pitfall: patches that add guards without fully understanding how different configuration modes compile internally can leave alternate code paths unmitigated.

Technical Analysis

Fastify derives several security-critical request attributes — request.host, request.protocol, request.hostname, request.ip, and request.ips — from forwarded headers when the trustProxy option is enabled. These values are used for a variety of downstream security decisions: URL generation, HTTPS enforcement, secure-cookie validation, CSRF origin checks, and host-based routing logic.

The vulnerability arises from an interaction between the original patch for CVE-2026-3635 and Fastify's trustProxy implementation modes. The CVE-2026-3635 patch introduced a guard on forwarded-header reads that checks whether the connecting peer address is a trusted proxy. This guard works correctly for three of the four trustProxy configuration modes:

• IP form (trustProxy: '127.0.0.1'): Compiles to a predicate that compares the connecting socket address to the specified IP.
• CIDR form (trustProxy: '10.0.0.0/8'): Compiles to a predicate that checks whether the connecting address falls within the specified network block.
• Custom-function form: Compiles to a user-supplied function that receives the connecting address and returns a boolean decision.

The guard fails for the numeric (hop-count) form (trustProxy: 1, trustProxy: 2, etc.). With this configuration, Fastify compiles the setting to a predicate that structurally ignores the connecting address entirely — it only decrements a hop counter and validates the forwarded chain depth. Consequently, the guard added for CVE-2026-3635 is always satisfied for any hop count of one or more, regardless of who the actual connecting peer is.

This means an attacker who can reach the Fastify origin directly — bypassing the front-facing reverse proxy that the numeric hop count was meant to account for — can fully forge X-Forwarded-* headers and control the derived request attributes exactly as if the original CVE-2026-3635 had never been patched. The affected version range is Fastify 5.8.3 up to but not including 5.12.1. The patch in 5.12.1 disables the numeric form of trustProxy at runtime and removes it from the TypeScript type union, effectively forcing users to adopt address-validating forms.

Exploitation Scenarios

Reconnaissance / Target Identification. An attacker must first identify a Fastify application that (a) runs a vulnerable version (5.8.3 through 5.12.0), (b) has trustProxy configured with a numeric value (1, 2, etc.), and (c) is directly reachable on the network independent of its front-facing reverse proxy. Numeric trustProxy is a common configuration for applications deployed behind a single load balancer or CDN (e.g., trustProxy: 1). Direct origin reachability frequently occurs in misconfigured environments where security groups, firewall rules, or cloud load balancer settings fail to restrict origin access to proxy IPs only. Attackers may discover the origin IP through DNS history records, leaked configuration files, or by scanning for certificate mismatches.

Triggering the Flaw. Once the attacker has network access to the origin, they send an HTTP request directly to the Fastify server — bypassing the intended reverse proxy. The request includes forged forwarded headers (e.g., X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-For). Because the numeric trustProxy mode compiles to a predicate that ignores the connecting address, the flawed guard from CVE-2026-3635 is trivially satisfied: any hop count ≥ 1 passes the check, and the connecting peer (the attacker) is incorrectly treated as a trusted proxy. Fastify then derives request.host, request.protocol, request.hostname, request.ip, and request.ips from the attacker-controlled headers.

Payload Construction. The attacker crafts a request with manipulated forwarded headers. For example:

• X-Forwarded-Host: evil.example.com → poisons host-derived URL generation.
• X-Forwarded-Proto: http → bypasses HTTPS-enforcement logic.
• X-Forwarded-For: <victim-IP> → spoofs client IP for rate-limiting bypass or audit-log poisoning.

No specific tooling or exploit code is required — a standard HTTP client (curl, Burp Suite, or a simple script) suffices. No public PoC exists at the time of writing; the attack chain is inferred directly from the vulnerability description.

Post-Exploitation Impact. Depending on how the application uses the derived values, the attacker can achieve:

1. Host injection: Poisoning generated URLs (e.g., password-reset links, redirects) to point to attacker-controlled domains, facilitating phishing.
2. HTTPS-enforcement bypass: Making the application believe the request arrived over plain HTTP, potentially disabling transport-security checks.
3. Secure-cookie bypass: If cookie validation logic depends on host/protocol attributes, the attacker may be able to invalidate or manipulate cookie-scoping decisions.
4. CSRF-origin bypass: Origin checks that compare the request origin to the host value can be satisfied with an attacker-controlled host, defeating CSRF protections.
5. Host-based routing and cache poisoning: In multi-tenant deployments where routing decisions depend on the Host header, an attacker can route requests to unintended tenants or poison a shared cache with malicious content served to legitimate users.

Impact Assessment

CVSS Score: 6.1 (Medium) — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N. The vector indicates: adjacent-network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change from the vulnerable component to other systems. The confidentiality impact is high (C:H) because host-injection and cache-poisoning scenarios can leak sensitive data or redirect users to attacker infrastructure; integrity and availability impacts are not scored.

Business Impact. The practical severity is higher than the numeric score suggests in real-world deployment scenarios. Fastify is a widely used web framework for Node.js, particularly popular for microservices and API gateways. Any organization running a Fastify service with numeric trustProxy behind a reverse proxy — a very common topology — is at risk if the origin is reachable beyond the proxy chain. The integrity-adjacent impacts (HTTPS bypass, CSRF bypass, secure-cookie bypass) undermine core web security controls, potentially enabling session hijacking, account takeover, or cache poisoning in downstream systems.

Blast Radius. The vulnerability affects all Fastify services running versions 5.8.3 through 5.12.0 with numeric trustProxy configuration. The attack requires adjacent-network access to the origin (AV:A), which raises the bar slightly but is frequently satisfied by the same network segmentation flaws that allow direct origin access.

Detection Guidance

Sigma Rule

title: Fastify Numeric trustProxy Forged Forwarded Headers (CVE-2026-16732)
id: 4c3f0e1a-7b2d-4e8f-9a1c-5d6e7f8a9b0c
status: experimental
description: Detects HTTP requests to Fastify origins with suspicious forwarded headers that may indicate spoofing attempts targeting vulnerable numeric trustProxy configurations (CVE-2026-16732).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16732
tags:
    - attack.t1190
    - cve.2026.16732
logsource:
    category: webserver
    product: fastify
detection:
    selection_origin:
        # Requests arriving on the origin, bypassing the intended reverse proxy
        # Detect via access logs where source IP is NOT in the trusted proxy range
        c-ip|outside: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16]
    selection_forwarded:
        cs-headers|contains|all:
            - 'X-Forwarded-Host'
            - 'X-Forwarded-Proto'
            - 'X-Forwarded-For'
    selection_hopcount:
        # Numeric trustProxy typically expects a limited hop chain
        # Requests with more forwarded hops than configured proxies suggest spoofing
        cs-headers|endswith: 'X-Forwarded-For:'
    condition: selection_origin and selection_forwarded
    timeframe: 1m
level: high
falsepositives:
    - Legitimate reverse proxy chains with proper network configuration
    - Health-check probes from monitoring systems that send forwarded headers
fields:
    - c-ip
    - cs-host
    - cs-headers

YARA Rule

rule Fastify_CVE_2026_16732_Numeric_trustProxy
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects Fastify source code or configuration artifacts containing numeric trustProxy settings that are vulnerable to CVE-2026-16732 (versions 5.8.3 through 5.12.0)."
        cve = "CVE-2026-16732"
        date = "2026-02-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16732"
        score = 60
    strings:
        // Match numeric trustProxy assignments in JavaScript/TypeScript source
        $trustProxy = /trustProxy\s*:\s*\d+/
        $trustProxy2 = /trustProxy\s*=\s*\d+/
        $trustProxy_option = /trustProxy\s*,\s*\d+\s*\)/
        
        // Hardcoded http server creation with numeric proxy trust
        $fastify_init = /fastify\s*\(\s*\{[^}]*tracking/
        $fastify_create = /\.listen\s*\(/
        
        // Package references indicating vulnerable version range markers
        $fastify_pkg = /"name"\s*:\s*"fastify"/
        $version_marker = /"version"\s*:\s*"(5\.[8-9]\.\d+|5\.1[0-2]\.\d+)"/
    condition:
        ($trustProxy or $trustProxy2 or $trustProxy_option) and 
        ($fastify_init or $fastify_create or $fastify_pkg) and
        filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"FASTIFY CVE-2026-16732 Potential Numeric trustProxy Spoofing via Forwarded Headers";
    content:"GET ";
    http_header;
    content:"X-Forwarded-Host", nocase;
    http_header;
    content:"X-Forwarded-Proto", nocase;
    http_header;
    content:"X-Forwarded-For", nocase;
    http_header;
    pcre:"/^X-Forwarded-(?:Host|Proto|For):.+/Im";
    classtype:attempted-admin;
    sid:6716332;
    rev:1;
    metadata:created_at 2026-02-15, updated_at 2026-02-15, cve CVE-2026-16732;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-16732;
)

Note: This rule detects the presence of multiple forwarded headers from sources that may not be trusted proxies. Operators should tune the rule to exclude known legitimate proxy IP ranges and apply it to interfaces facing the origin server (not the proxy-facing port).

Elastic Detection

// EQL query to detect direct-to-origin requests with spoofed forwarded headers
// Run against access.log index or packetbeat data
sequence by source.ip, destination.ip with maxspan=1m
    [ network where network.protocol == "http" and 
      source.ip != "10.0.0.0/8" and source.ip != "172.16.0.0/12" and source.ip != "192.168.0.0/16" and
      destination.port in (3000, 8080, 8000) ]
    [ http where http.request.headers contains "X-Forwarded-Host" and 
      http.request.headers contains "X-Forwarded-Proto" and
      http.request.headers contains "X-Forwarded-For" and
      // suspicious: source not in proxy subnet but forwarding headers present
      not source.ip in ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] ]

Splunk SPL Query

index=proxy OR index=webserver sourcetype="access_combined"
| where NOT c_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  AND useragent!="healthcheck" 
  AND (http_user_agent IN ("curl*", "wget*", "python-requests*") OR http_method IN ("POST", "PUT"))
| rex field=_raw "X-Forwarded-Host:\s+(?<x_fwd_host>[^,;\s]+)"
| rex field=_raw "X-Forwarded-Proto:\s+(?<x_fwd_proto>[^,;\s]+)"
| rex field=_raw "X-Forwarded-For:\s+(?<x_fwd_for>[^,;\s]+)"
| where isnotnull(x_fwd_host) AND isnotnull(x_fwd_proto) AND isnotnull(x_fwd_for)
| eval host_mismatch=if(match(cs_host, x_fwd_host), "match", "MISMATCH")
| where host_mismatch="MISMATCH"
| stats count by c_ip, cs_host, x_fwd_host, x_fwd_proto, x_fwd_for, _time
| sort - _time
| table _time, c_ip, cs_host, x_fwd_host, x_fwd_proto, x_fwd_for, count

Wazuh OSSEC Rule

<group name="fastify,">
  <rule id="671632" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.\*</field>
    <field name="srcip">!10\.0\.0\.0|!172\.16\.0\.0|!192\.168\.0\.0</field>
    <regex>X-Forwarded-Host\s*:</regex>
    <regex>X-Forwarded-Proto\s*:</regex>
    <regex>X-Forwarded-For\s*:</regex>
    <description>Fastify CVE-2026-16732: Direct origin access attempt with spoofed forwarded headers (numeric trustProxy bypass).</description>
    <group>fastify,web_application_attack,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <alert_op>2</alert_op>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY) — Two independent sources (NVD and OSV) confirm the fix.

1. Immediate mitigations (do these first):

   • Restrict origin access: Ensure the Fastify origin is only reachable through the trusted proxy chain. Configure firewalls, security groups, or cloud network ACLs to only allow inbound traffic from proxy IPs (load balancer, CDN, reverse proxy addresses) on the application port. This neutralizes the attack vector even on vulnerable versions.
   • Change trustProxy configuration: Replace any numeric trustProxy value with an IP, CIDR, or custom-function form that validates the connecting address. For a single proxy, use trustProxy: '127.0.0.1' (or the actual proxy IP) instead of trustProxy: 1. This directly defeats the flaw since the vulnerable guard works correctly for address-validating forms.
   • Monitor for indicators: Review access logs for requests originating from non-proxy IPs that carry X-Forwarded-* headers — a clear sign of either direct access or spoofing attempts.

2. Patch / Upgrade Steps:

   • Upgrade Fastify to version 5.12.1 or later in all affected services. This version disables the numeric form of trustProxy at runtime and removes it from the TypeScript type union.
   • After upgrading, audit codebases and configuration files for numeric trustProxy usage — the upgrade will cause runtime failures for such configurations, so identify and migrate them proactively.
   • Run npm audit or equivalent dependency scanning to identify all Fastify installations in the vulnerable range across your organization.

3. Long-term Hardening:

   • Adopt a security standard that mandates address-validating proxy trust configuration across all Node.js services.
   • Implement runtime detection rules (Sigma, Wazuh, Splunk above) to alert on direct-origin access with forwarded headers — treat this as a high-priority security event.
   • Add the Fastify origin to network-segmentation best practices: origins should never be directly exposed to the internet or untrusted networks, regardless of proxy configuration.
   • Track patches for incomplete-fix lineage carefully. This CVE demonstrates that security patches can miss alternate code paths — re-verify protection mechanisms after each configuration change.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16732
2. OSV Database Entry: https://osv.dev/vulnerability/CVE-2026-16732
3. Parent CVE (CVE-2026-3635): https://nvd.nist.gov/vuln/detail/CVE-2026-3635 — the original vulnerability that CVE-2026-16732 reopens for numeric trustProxy configurations.
4. Fastify Official GitHub: https://github.com/fastify/fastify — monitor releases and advisories for patched version 5.12.1 and related security notices.
5. Fastify Official Documentation (trustProxy): https://fastify.dev/docs/latest/Reference/Server/ — reference for trustProxy configuration options and semantics.

Campaign/Exploit-in-the-Wild Evidence: No public PoC or exploit code exists at the time of writing. CVE-2026-16732 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS score is 0.00144 (4.0th percentile of exploited CVEs), indicating low immediate exploitation likelihood. However, given that this vulnerability reopens the parent CVE-2026-3635 impact class for a very common configuration pattern (single reverse proxy with trustProxy: 1), organizations should prioritize patching rather than relying on low EPSS scores to defer action.