fastify npm Package Vulnerability: X-Forwarded-* Spoofing Risk

Severity

HIGH

Affected component

fastify (npm)

Affected versions

>= v5.8.2, <= v5.8.2 or >= v5.8.1, <= v5.8.1 or >= v5.8.0, <= v5.8.0 or >= v5.7.4, <= v5.7.4 or >= v5.7.3, <= v5.7.3 or >= v5.7.2, <= v5.7.2 or >= v5.7.1, <= v5.7.1 or >= v5.7.0, <= v5.7.0 or >= v5.6.2, <= v5.6.2 or >= v5.6.1, <= v5.6.1 or >= v5.6.0, <= v5.6.0 or >= v5.5.0, <= v5.5.0 or >= v5.4.0, <= v5.4.0 or >= v5.3.3, <= v5.3.3 or >= v5.3.2, <= v5.3.2 or >= v5.3.1, <= v5.3.1 or >= v5.3.0, <= v5.3.0 or >= v5.2.2, <= v5.2.2 or >= v5.2.1, <= v5.2.1 or >= v5.2.0, <= v5.2.0 or >= v5.1.0, <= v5.1.0 or >= v5.0.0, <= v5.0.0 or >= v5.0.0-alpha.4, <= v5.0.0-alpha.4 or >= v5.0.0-alpha.2, <= v5.0.0-alpha.2 or >= v5.0.0-alpha.1, <= v5.0.0-alpha.1 or >= v4.5.2, <= v4.5.2 or >= v4.5.1, <= v4.5.1 or >= v4.5.0, <= v4.5.0 or >= v4.4.0, <= v4.4.0 or >= v4.3.0, <= v4.3.0 or >= v4.2.1, <= v4.2.1 or >= v4.2.0, <= v4.2.0 or >= v4.1.0, <= v4.1.0 or >= v4.0.3, <= v4.0.3 or >= v4.0.2, <= v4.0.2 or >= v4.0.1, <= v4.0.1 or >= v4.0.0, <= v4.0.0 or >= v4.0.0-rc.5, <= v4.0.0-rc.5 or >= v4.0.0-rc.4, <= v4.0.0-rc.4 or >= v4.0.0-rc.3, <= v4.0.0-rc.3 or >= v4.0.0-rc.2, <= v4.0.0-rc.2 or >= v4.0.0-rc.1, <= v4.0.0-rc.1 or >= v4.0.0-alpha.3, <= v4.0.0-alpha.3 or >= v4.0.0-alpha.2, <= v4.0.0-alpha.2 or >= v3.27.2, <= v3.27.2 or >= v4.0.0-alpha.1, <= v4.0.0-alpha.1 or >= v3.27.1, <= v3.27.1 or >= v3.27.0, <= v3.27.0 or >= v3.26.0, <= v3.26.0 or >= v3.25.3, <= v3.25.3 or >= v3.25.2, <= v3.25.2 or >= v3.25.1, <= v3.25.1 or >= v3.25.0, <= v3.25.0 or >= v3.24.1, <= v3.24.1 or >= v3.24.0, <= v3.24.0 or >= v3.23.1, <= v3.23.1 or >= v3.23.0, <= v3.23.0 or >= v3.22.1, <= v3.22.1 or >= v3.22.0, <= v3.22.0 or >= v3.21.6, <= v3.21.6 or >= v3.21.5, <= v3.21.5 or >= v3.21.4, <= v3.21.4 or >= v3.21.3, <= v3.21.3 or >= v3.21.2, <= v3.21.2 or >= v3.21.1, <= v3.21.1 or >= v3.21.0, <= v3.21.0 or >= v3.20.2, <= v3.20.2 or >= v3.20.1, <= v3.20.1 or >= v3.20.0, <= v3.20.0 or >= v3.19.2, <= v3.19.2 or >= v3.19.1, <= v3.19.1 or >= v3.19.0, <= v3.19.0 or >= v3.18.1, <= v3.18.1 or >= v3.18.0, <= v3.18.0 or >= v3.17.0, <= v3.17.0 or >= v3.16.2, <= v3.16.2 or >= v3.16.1, <= v3.16.1 or >= v3.16.0, <= v3.16.0 or >= v3.15.1, <= v3.15.1 or >= v3.15.0, <= v3.15.0 or >= v3.14.2, <= v3.14.2 or >= v3.14.1, <= v3.14.1 or >= v3.14.0, <= v3.14.0 or >= v3.13.0, <= v3.13.0 or >= v3.12.0, <= v3.12.0 or >= v3.11.0, <= v3.11.0 or >= v3.10.1, <= v3.10.1 or >= v3.10.0, <= v3.10.0 or >= v3.9.2, <= v3.9.2 or >= v3.9.1, <= v3.9.1 or >= v3.9.0, <= v3.9.0 or >= v3.8.0, <= v3.8.0 or >= v3.7.0, <= v3.7.0 or >= v3.6.0, <= v3.6.0 or >= v3.5.1, <= v3.5.1 or >= v3.5.0, <= v3.5.0 or >= v3.4.1, <= v3.4.1 or >= v3.4.0, <= v3.4.0 or >= v3.3.0, <= v3.3.0 or >= v3.2.1, <= v3.2.1 or >= v3.2.0, <= v3.2.0 or >= v3.1.1, <= v3.1.1 or >= v3.1.0, <= v3.1.0 or >= v3.0.3, <= v3.0.3 or >= v3.0.2, <= v3.0.2 or >= v3.0.1, <= v3.0.1 or >= v3.0.0, <= v3.0.0 or >= v3.0.0-rc.5, <= v3.0.0-rc.5 or >= v2.15.1, <= v2.15.1 or >= v3.0.0-rc.4, <= v3.0.0-rc.4 or >= v3.0.0-rc.3, <= v3.0.0-rc.3 or >= v3.0.0-rc.2, <= v3.0.0-rc.2 or >= v2.14.0, <= v2.14.0 or >= v3.0.0-rc.1, <= v3.0.0-rc.1 or >= v3.0.0-alpha.1, <= v3.0.0-alpha.1 or >= v2.3.0, <= v2.3.0 or >= v2.2.0, <= v2.2.0 or >= v2.1.0, <= v2.1.0 or >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v2.0.0-rc.6, <= v2.0.0-rc.6 or >= v2.0.0-rc.5, <= v2.0.0-rc.5 or >= v2.0.0-rc.4, <= v2.0.0-rc.4 or >= v2.0.0-rc.3, <= v2.0.0-rc.3 or >= v2.0.0-rc.2, <= v2.0.0-rc.2 or >= v2.0.0-rc.1, <= v2.0.0-rc.1 or >= v2.0.0-rc.0, <= v2.0.0-rc.0 or >= v1.13.0, <= v1.13.0 or >= v1.12.1, <= v1.12.1 or >= v1.12.0, <= v1.12.0 or >= v1.11.2, <= v1.11.2 or >= v1.11.1, <= v1.11.1 or >= v1.11.0, <= v1.11.0 or >= v1.10.0, <= v1.10.0 or >= v1.9.0, <= v1.9.0 or >= v1.8.0, <= v1.8.0 or >= v1.7.0, <= v1.7.0 or >= v1.6.0, <= v1.6.0 or >= v1.5.0, <= v1.5.0 or >= v1.4.0, <= v1.4.0 or >= v1.3.1, <= v1.3.1 or >= v1.3.0, <= v1.3.0 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.1.1, <= v1.1.1 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= v1.0.0-rc.3, <= v1.0.0-rc.3 or >= v1.0.0-rc.2, <= v1.0.0-rc.2 or >= v1.0.0-rc.1, <= v1.0.0-rc.1 or >= v0.43.0, <= v0.43.0 or >= v0.42.0, <= v0.42.0 or >= v0.41.0, <= v0.41.0 or >= v0.40.0, <= v0.40.0 or >= v0.39.1, <= v0.39.1 or >= v0.39.0, <= v0.39.0 or >= v0.38.0, <= v0.38.0 or >= v0.37.0, <= v0.37.0 or >= v0.36.0, <= v0.36.0 or >= v0.35.7, <= v0.35.7 or >= v0.35.6, <= v0.35.6 or >= v0.35.5, <= v0.35.5 or >= v0.35.4, <= v0.35.4 or >= v0.35.3, <= v0.35.3 or >= v0.35.2, <= v0.35.2 or >= v0.35.1, <= v0.35.1 or >= v0.35.0, <= v0.35.0 or >= v0.34.0, <= v0.34.0 or >= v0.33.0, <= v0.33.0 or >= v0.32.0, <= v0.32.0 or >= v0.31.0, <= v0.31.0 or >= v0.30.3, <= v0.30.3 or >= v0.30.1, <= v0.30.1 or >= v0.30.2, <= v0.30.2 or >= v0.30.0, <= v0.30.0 or >= v0.29.2, <= v0.29.2 or >= v0.29.1, <= v0.29.1 or >= v0.29.0, <= v0.29.0 or >= v0.28.2, <= v0.28.2 or >= v0.28.1, <= v0.28.1 or >= v0.28.0, <= v0.28.0 or >= v0.27.0, <= v0.27.0 or >= v0.26.2, <= v0.26.2 or >= v0.26.1, <= v0.26.1 or >= v0.26.0, <= v0.26.0 or >= v0.25.3, <= v0.25.3 or >= v0.25.2, <= v0.25.2 or >= v0.25.1, <= v0.25.1 or >= v0.25.0, <= v0.25.0 or >= v0.24.0, <= v0.24.0 or >= v0.22.0, <= v0.22.0 or >= v0.23.0, <= v0.23.0 or >= v0.21.0, <= v0.21.0 or >= v0.20.1, <= v0.20.1 or >= v0.20.0, <= v0.20.0 or >= v0.19.1, <= v0.19.1 or >= v0.19.0, <= v0.19.0 or >= v0.18.0, <= v0.18.0 or >= v0.17.0, <= v0.17.0 or >= v0.16.0, <= v0.16.0 or >= v0.15.3, <= v0.15.3 or >= v0.15.2, <= v0.15.2 or >= v0.15.1, <= v0.15.1 or >= v0.15.0, <= v0.15.0 or >= v0.14.1, <= v0.14.1 or >= v0.14.0, <= v0.14.0 or >= v0.13.1, <= v0.13.1 or >= v0.13.0, <= v0.13.0 or >= v0.12.0, <= v0.12.0 or >= v0.11.1, <= v0.11.1 or >= v0.11.0, <= v0.11.0 or >= v0.10.0, <= v0.10.0 or >= v0.9.0, <= v0.9.0 or >= v0.8.0, <= v0.8.0 or >= v0.7.1, <= v0.7.1 or >= v0.7.0, <= v0.7.0 or >= v0.6.0, <= v0.6.0 or >= v0.5.0, <= v0.5.0 or >= v0.4.0, <= v0.4.0 or >= v0.3.0, <= v0.3.0 or >= v0.2.0, <= v0.2.0 or >= v0.1.0, <= v0.1.0

Patched version

5.12.1

An early warning has been issued for a high-severity vulnerability in the fastify npm package. This vulnerability allows X-Forwarded-* spoofing under certain trustProxy configurations, potentially enabling host injection attacks.

What happened

The fastify npm package is reportedly vulnerable to X-Forwarded-* spoofing when configured with specific trustProxy settings. This vulnerability could allow an attacker to bypass security controls and perform host injection attacks. The vulnerability affects a wide range of fastify versions, from v0.1.0 to v5.8.2, inclusive. The issue is under investigation and has not yet been exploited in the wild.

The vulnerability arises from improper handling of X-Forwarded-* headers in the fastify package when the trustProxy option is enabled with a hop-count configuration. An attacker could exploit this by manipulating these headers to spoof the origin of a request, potentially leading to host injection attacks.

What to do about it

• Upgrade to fastify version 5.12.1 or later to mitigate the vulnerability.
• Review your fastify configuration to ensure trustProxy settings are secure and do not expose your application to spoofing attacks.
• Monitor the primary sources for updates on this vulnerability and any additional mitigation advice.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [GHSA-3m5p-2c4r-xxw2] fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Join the 0Day waitlist →

← Back to all threats