Fastify Trust Proxy Vulnerability Allows Request Header Spoofing from Untrusted Connections

A vulnerability exists in Fastify versions through 5.8.2 when the trustProxy setting is configured with a restrictive trust function. In this scenario, the request.protocol and request.host getters can be manipulated to read the X-Forwarded-Proto and X-Forwarded-Host headers from untrusted connections. This exploitation allows an attacker to spoof the protocol and host information seen by the application, potentially bypassing security measures that rely on these headers.

Impact

This vulnerability can lead to security decisions being based on spoofed header information, which could undermine HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, and host-based routing.

Remediation

Users can upgrade to Fastify version 5.8.3 or later to address this vulnerability.