When Fastify’s trustProxy setting is configured with a restrictive trust function, the framework still allows any incoming connection to supply X-Forwarded-Proto and X-Forwarded-Host headers. An attacker who connects directly to the Fastify server, without going through a trusted proxy, can therefore instruct the application to believe it is being accessed over HTTPS or via a different host. This manipulation can break security controls that rely on request.protocol and request.host, enabling misissued secure cookies, incorrect URL generation, flawed host-based routing, and potential CSRF bypasses. The underlying weakness is an improper extraction of forwarded headers in the presence of a sanitized trust proxy function.

Fastify versions 5.8.2 and earlier are affected. The advisory specifically lists fastify <= 5.8.2 as vulnerable.

The CVSS v3 base score is 6.1, indicating a medium severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is an attacker directly connecting to the Fastify application over an untrusted network and sending malicious X-Forwarded-Proto and X-Forwarded-Host headers, which the framework will accept under the described configuration. The vulnerability requires the attacker to have network connectivity to the server, but no privileged access or code execution is necessary. While the likelihood of automated exploitation is uncertain, the configuration error is simple enough that a determined attacker could exploit it manually.