CVE-2026-3635: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3635 is a header spoofing vulnerability in the Fastify Node.js web framework, formally titled "request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections." When trustProxy is configured with a restrictive trust function (e.g., a specific IP, subnet, hop count, or custom function), the request.protocol and request.host getters incorrectly read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including those from untrusted IPs — allowing an attacker to bypass the proxy and spoof both values. All Fastify versions up to and including 5.8.2 for Node.js are affected; version 5.8.3 contains the fix. It carries a CVSS v3.1 base score of 6.1 (Medium), assigned by the OpenJS Foundation CNA (Github Advisory, Github Advisory DB).

The root cause is classified as CWE-348 (Use of Less Trusted Source): Fastify's request.protocol and request.host getters consume X-Forwarded-Proto and X-Forwarded-Host headers without first verifying that the originating connection is trusted according to the configured trustProxy policy. The flaw only manifests when trustProxy is set to a restrictive value (specific IP, subnet, hop count, or custom function); when trustProxy: true is used, trusting all forwarded headers is the intended behavior. An attacker with adjacent network access can connect directly to the Fastify process (bypassing the reverse proxy) and inject arbitrary X-Forwarded-Proto or X-Forwarded-Host header values, causing the application to act on spoofed protocol and host information (Github Advisory, Red Hat Bugzilla).

Applications that rely on request.protocol or request.host for security-sensitive decisions are at risk, including HTTPS enforcement, secure cookie flag assignment, CSRF origin validation, URL construction, and host-based routing. A successful attack can lead to protocol downgrade scenarios (tricking the application into treating an HTTP connection as HTTPS), host spoofing for authentication or routing bypass, and improper cookie security flags — all of which can result in high confidentiality impact within a changed scope. Integrity and availability are not directly impacted by this vulnerability (Github Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (2nd percentile), indicating a low near-term probability of exploitation (Github Advisory DB). Exploitation requires adjacent network access and a specific (restrictive) trustProxy configuration, raising the attack complexity.

1. Reconnaissance: Identify a Fastify application (version ≤ 5.8.2) that is deployed behind a reverse proxy with a restrictive trustProxy configuration (e.g., trustProxy: '10.0.0.1' or a subnet/hop-count setting) and that uses request.protocol or request.host for security decisions.
2. Gain adjacent network access: Position on the same network segment as the Fastify process, or identify a path to connect directly to the Fastify port (bypassing the reverse proxy), since the attack vector is adjacent network.
3. Craft a spoofed HTTP request: Send an HTTP request directly to the Fastify server (not through the trusted proxy) with forged headers, for example:

   GET /secure-endpoint HTTP/1.1
   Host: legitimate-host.example.com
   X-Forwarded-Proto: https
   X-Forwarded-Host: attacker-controlled.example.com

4. Trigger security bypass: Because Fastify does not validate that the connection originates from a trusted source before reading X-Forwarded-Proto/X-Forwarded-Host, request.protocol returns https and request.host returns the attacker-supplied value, causing the application to make security decisions based on spoofed data.
5. Achieve objective: Depending on application logic, this may result in bypassing HTTPS-only enforcement, manipulating CSRF origin checks, influencing host-based routing, or causing insecure cookie flags to be set — potentially exposing sensitive session or application data (Github Advisory).

• Network: Unexpected direct HTTP connections to the Fastify application port (bypassing the configured reverse proxy), particularly from IP addresses not matching the trusted proxy configuration; requests containing X-Forwarded-Proto or X-Forwarded-Host headers originating from untrusted source IPs.
• Logs: Application access logs showing requests with X-Forwarded-Proto: https or unusual X-Forwarded-Host values from source IPs that do not match the configured trusted proxy address or subnet; repeated requests to security-sensitive endpoints (login, CSRF-protected routes, cookie-setting endpoints) with mismatched forwarded headers.
• Application Behavior: Unexpected protocol or host values appearing in application-generated URLs, redirects, or cookies that do not match the actual deployment environment; CSRF validation failures or bypasses correlated with unusual X-Forwarded-Host values in logs.

Upgrade Fastify to version 5.8.3 or later, which was released on March 23, 2026, and directly addresses this vulnerability (Fastify v5.8.3 Release). As a workaround for applications that cannot immediately upgrade, avoid relying solely on request.protocol or request.host for security-critical decisions; instead, implement independent HTTPS enforcement and CSRF token validation that does not depend on these header-derived values. Additionally, ensure network-level controls prevent direct connections to the Fastify process from untrusted sources, enforcing that all traffic passes through the configured trusted proxy. IBM API Connect users should consult the relevant IBM advisories for patched versions (IBM Advisory).

The advisory was published by Fastify maintainer Matteo Collina (mcollina) on March 23, 2026, with remediation review credited to climba03003 and UlisesGascon; the vulnerability was reported by TinkAnet (Github Advisory). Red Hat tracked the issue via Bugzilla and assessed it as medium severity (Red Hat Bugzilla). IBM issued advisories for affected API Connect products in May 2026 (IBM Advisory). No significant broader community controversy or notable social media discussion has been identified beyond standard vulnerability tracking.