Impact
The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a proxyFn(socket.remoteAddress, 0) guard on the X-Forwarded-* reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (trustProxy: <number>) compiles to a predicate that structurally ignores the address argument, so the guard reduces to 0 < tp, always true for any tp >= 1.
Applications configured with trustProxy: <number> (documented as "behind N reverse proxies", trustProxy: 1 being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.
Patches
Patched in fastify 5.12.1. The numeric form of trustProxy is now disabled at runtime and removed from the TypeScript type union.
Workarounds
- Migrate to an IP / CIDR / custom-function
trustProxy value that validates the connecting address. Custom functions must inspect the address argument, not only the hop index.
- Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).
References
alimony Reporter
mcollina Remediation developer
climba03003 Remediation reviewer
UlisesGascon Remediation reviewer
Impact
The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a
proxyFn(socket.remoteAddress, 0)guard on theX-Forwarded-*reads inrequest.host,request.protocol,request.hostname,request.ip, andrequest.ips. That guard closes the IP, CIDR, and custom-function forms oftrustProxycorrectly because those forms compile to predicates that inspect the connecting address. The hop-count form (trustProxy: <number>) compiles to a predicate that structurally ignores the address argument, so the guard reduces to0 < tp, always true for anytp >= 1.Applications configured with
trustProxy: <number>(documented as "behind N reverse proxies",trustProxy: 1being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.Patches
Patched in fastify 5.12.1. The numeric form of
trustProxyis now disabled at runtime and removed from the TypeScript type union.Workarounds
trustProxyvalue that validates the connecting address. Custom functions must inspect theaddressargument, not only the hop index.References