THREAT OPS › Threat News › [GHSA] GHSA-3m5p-2c4r-xxw2 (medium) — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
[GHSA] GHSA-3m5p-2c4r-xxw2 (medium) — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
GHSA-3m5p-2c4r-xxw2 Severity: medium CVE: CVE-2026-16732
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
## Impact
The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a `proxyFn(socket.remoteAddress, 0)` guard on the `X-Forwarded-*` reads in `
Indicators of compromise
- CVE-2026-16732cve
- CVE-2026-3635cve
- https://www.cve.org/CVERecord?id=CVE-2026-3635url
Original source: https://github.com/advisories/GHSA-3m5p-2c4r-xxw2