The flaw occurs in the @fastify/forwarded library, which resolves client addresses from the X-Forwarded-For header. In versions prior to 3.0.2, the parser trims only space characters from comma-separated entries and does not strip horizontal tabs, despite RFC 7230 allowing whitespace to include both space and tab. This means that an entry padded with a tab is stored with the literal tab character, producing a corrupted address string that no longer matches exact string‑based security controls such as allowlists, blocklists, per‑IP rate limiting keys, or audit log correlation. Because the corrupted string is not a valid IP address, it cannot be mistaken for a trusted proxy, so the vulnerability does not cross a trust boundary. However, it does enable the bypass of IP‑based security decisions that rely on precise string comparison. Based on the description, it is inferred that applications using this library for IP validation can be evaded by an attacker who injects a tab character into the X‑Forwarded‑For header.

Vulnerable systems include any Node.js applications that depend on @fastify/forwarded before version 3.0.2. The fix is available in @fastify/forwarded 3.0.2 and later. No other vendors or products are explicitly affected according to the CNA data.

Based on the description, it is inferred that the most common attack vector involves injecting a crafted X‑Forwarded‑For header containing a tab‑augmented IP segment. The CVSS score of 5.3 indicates a moderate rating; the EPSS score of less than 1% implies a low probability of exploitation in the near term. The vulnerability is not listed in CISA KEV, further suggesting limited exploitation risk. The attack can be carried out by injecting a crafted X‑Forwarded‑For header containing a tab‑augmented IP segment, which is a trivial HTTP request modification. No local privileges or elevated permissions are required, and the attack is limited to the application level. However, because many web frameworks rely on exact IP string matches for security controls, widespread bypass could be achieved if the vulnerability goes unfixed.