fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
Affected releases · fastify
- 5.x5.0.0 – 5.8.2Fixed in 5.8.3
- 4.x and older0.0.1 – 4.29.1No fix, no longer updated
On 5.x, the newest line:
npm install fastify@5.8.3Affected
5.0.0 – 5.8.2
22 releases
Fixed
5.8.3 – 5.12.7
17 releases, latest
Affected
4.0.0 – 4.29.1
61 releases
Affected
3.0.0 – 3.29.5
71 releases
Affected
2.0.0 – 2.15.3
25 releases
Affected
1.0.0 – 1.14.6
31 releases
Affected
0.0.1 – 0.43.0
73 releases
Is your project affected?
Paste your package.json, or type the range you declare for fastify. It is read in your browser and sent nowhere.
What happens
Summary
When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.
Affected Versions
fastify <= 5.8.2
Impact
Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.
When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.