Fastify Ecosystem: Five Vulnerabilities Disclosed, Including Critical Proxy-Addr Flaw
A batch of five Fastify vulnerabilities, including critical and high severity flaws in @fastify/proxy-addr and @fastify/auth, were disclosed between September 15-17, 2026.
Key findings
- Critical vulnerability in @fastify/proxy-addr (CVE-2026-92395) affects client IP determination.
- @fastify/static path traversal possible on case-insensitive file systems (CVE-2026-90982).
- @fastify/auth authorization bypass flaw disclosed (CVE-2026-92087).
- Fastify core framework issue with HTTP/2 trailers and headers (CVE-2026-92081).
- fast-uri dependency vulnerability impacts URI parsing (CVE-2026-86472).
- Patches available across multiple Fastify packages, urging immediate updates.
On September 15-17, 2026, a batch of five vulnerabilities was disclosed across several Fastify-related packages, including the core framework, @fastify/static, @fastify/proxy-addr, and @fastify/auth. The most severe of these, CVE-2026-92395, is a critical vulnerability in @fastify/proxy-addr that could allow for improper trust subnet configuration when using IPv4-mapped IPv6 notation, potentially leading to incorrect client IP address determination.
Several medium and high severity issues were also detailed. CVE-2026-90982, a medium severity vulnerability in @fastify/static, allows for route guard bypass on case-insensitive file systems by altering the case of path segments. CVE-2026-92087, a high severity flaw in @fastify/auth, could lead to unintended authorization bypass when composing authentication strategies with specific "or" and "all" options. Additionally, CVE-2026-92081, a medium severity issue in the Fastify core framework, involves the unconditional setting of a forbidden Transfer-Encoding: chunked header over HTTP/2 when response trailers are used, causing Node.js to throw errors. Finally, CVE-2026-86472, a medium severity vulnerability in the fast-uri dependency, stems from incorrect host folding and percent-decoding order, potentially impacting URI parsing.
The vulnerabilities were patched in various versions: @fastify/static in 10.1.4, @fastify/proxy-addr in 5.1.1, @fastify/auth in 5.1.1, Fastify core in 5.12.5, and fast-uri in 2.4.7, 3.1.8, and 4.1.5. Users are advised to update to the patched versions to mitigate these security risks.
This batch of disclosures highlights the importance of keeping Fastify and its associated plugins updated, particularly concerning authentication, authorization, and request handling mechanisms. The range of affected packages underscores the interconnectedness of the Fastify ecosystem and the potential impact of vulnerabilities in even seemingly minor components.
CVE-2026-90982: @fastify/static path traversal on case-insensitive file systems. CVE-2026-92395: @fastify/proxy-addr trust subnet misconfiguration with IPv4-mapped IPv6. CVE-2026-92087: @fastify/auth authorization bypass via composed strategy options. CVE-2026-92081: Fastify core HTTP/2 trailer handling leading to forbidden header. CVE-2026-86472: fast-uri incorrect host folding and percent-decoding.