CVE-2026-16732

[CVE catalog]

Severity

Medium · CVSS 6.1CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Published

Aug 18, 2026, 8:30:22 PM UTC

Updated

Aug 18, 2026, 9:16:34 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.16% · Oct 25, 2026

A flaw was found in fastify. When configured with a numeric `trustProxy` value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, and can lead to secure-cookie and Cross-Site Request Forgery (CSRF) origin bypasses, as well as host-based routing and cache poisoning. fastify: fastify: Request spoofing via numeric trustProxy configuration This flaw in fastify allows request spoofing when the `trustProxy` configuration uses a numeric value and an attacker can directly access the Fastify origin, bypassing the front-facing proxy. This can lead to host injection in generated URLs, HTTPS-enforcement bypass, and secure-cookie/CSRF-origin bypass. Red Hat OpenShift Dev Spaces is affected by this vulnerability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.