Medium [CVE-2026-16732] Request spoofing via numeric trustProxy configuration
This medium-severity Red Hat Linux advisory covers CVE-2026-16732 affecting Red Hat OpenShift Dev Spaces.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address.
That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly, because those forms compile to predicates that inspect the connecting address. The hop-count form, where trustProxy is set to a number, compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more.
Applications configured with a numeric trustProxy value, such as trustProxy set to 1 for a single reverse proxy, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version.
The impact class matches the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. Affected versions are fastify from 5.8.3 up to but not including 5.12.1.
Patches: patched in fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union.
Affected product named by the advisory: Red Hat OpenShift Dev Spaces.
- 5.8.3
Official advisory · high-confidence parse· fetched 15 days ago·verify at source
Mitigation checklist
- To mitigate this issue, configure the `trustProxy` setting in fastify to use an IP address, CIDR range, or a custom function that explicitly validates the connecting address. Additionally, ensure that the Fastify origin is only accessible through the trusted proxy chain and not directly exposed to untrusted networks. Consult the fastify documentation for specific configuration details. Reloading or restarting the affected service may be required for changes to take effect.
Official advisory · high-confidence parse· fetched 15 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.