The vulnerability arises because the guard added to protect forwarded header reads at the time of CVE‑2026‑3635 does not apply to the numeric hop‑count form of trustProxy. When trustProxy is set to a number (e.g., 1 for a single reverse proxy), the guard always succeeds regardless of the connecting address, leaving applications that use this configuration exposed. Attacks that directly reach the Fastify origin can forge X‑Forwarded‑* headers, leading to host injection in URLs, HTTPS‑enforcement bypass, secure‑cookie and CSRF‑origin bypass, and host‑based routing and cache poisoning. This falls under CWE‑348 and CWE‑501.

The affected product is the Fastify web framework for Node.js, version 5.8.3 through 5.12.1 (exclusive). The security fix is bundled in 5.12.1 and later releases, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. Applications that cannot upgrade yet are advised to adjust their configuration settings.

The CVSS score of 6.1 indicates a moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation. Nonetheless, the attack requires direct network reach to the Fastify origin behind the proxy, which is common in improperly hardened deployments. An attacker can exploit this by sending forged headers that the server will accept, resulting in the aforementioned host‑based attacks. Immediate patching or configuration changes are recommended to eliminate the risk.