@fastify/forwarded resolves client addresses from the X-Forwarded-For header

CVE-2026-18174 targets @fastify/forwarded versions prior to 3.0.2. The library parses the X-Forwarded-For header and returns an array of IP-address strings for upstream consumers such as @fastify/proxy-addr, which feeds request.ip inside every Fastify application. The bug: when the header contains multiple entries separated by commas, the parser strips spaces (0x20) around each address but ignores horizontal tabs (0x09), even though RFC 7230 §3.2.3 defines optional whitespace (OWS) as both SP and HTAB. An attacker who sends X-Forwarded-For: 9.9.9.9,\t1.2.3.4 gets back "\t1.2.3.4" — a string with a leading tab — which fails any downstream exact-string comparison against an allowlist, blocklist, or rate-limit key. The single-entry fast path already called .trim() and was never affected; only the multi-entry code path was vulnerable.

The vendor scored this MEDIUM 5.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N — and that is directionally honest. The flaw is unauthenticated and network-reachable, but the impact ceiling is *Integrity-Low*: you can trick an IP comparison, not steal data or pop a shell. Real-world exploitation is further gated by reverse-proxy configuration: cloud load balancers (ALB, GCP LB, Cloudflare) and hardened nginx configs (proxy_set_header X-Forwarded-For $remote_addr) overwrite the header entirely, rendering the attack moot. noisgate concurs with the MEDIUM bucket but trims the score slightly to 4.8 to reflect these deployment-layer frictions.

Why this verdict

• Impact ceiling is Integrity-Low only. The CVSS vector explicitly scores C:N/I:L/A:N — no path to code execution, data theft, or service disruption exists from this parsing gap alone. It can only weaken one secondary control (IP matching).
• Proxy-layer friction reduces reachable population. Cloud load balancers (ALB, GCP LB, Cloudflare) and hardened nginx/HAProxy configurations overwrite X-Forwarded-For rather than appending, which eliminates the attacker's ability to inject the malicious tab character. A significant fraction of production Fastify deployments operate behind these overwrite-mode proxies.
• Exact-string comparison is a fragile code pattern. Exploiting the tab-prefix requires the downstream application to compare request.ip via === string equality against an allowlist or use it as a verbatim hash key. Mature rate-limiting libraries, CIDR-based ACLs, and IP-parsing routines normalize or reject malformed input, neutralizing the vector.
• Role multiplier: @fastify/forwarded is a Node.js utility library consumed inside web application tiers. It is not a canonically high-value infrastructure component (not a hypervisor, domain controller, kernel-mode agent, certificate authority, or network edge appliance). In the worst plausible high-value role — a Fastify-based API gateway — successful exploitation bypasses a rate limiter or IP ACL (tenant-scope impact), but does not chain to fleet compromise, domain takeover, or supply-chain pivot. The blast-radius floor does not push above MEDIUM.
• No exploitation evidence or weaponized tooling. The CVE is < 48 hours old, no PoC repos exist, no KEV listing, and no mass-scanning has been observed. The trivial nature of the payload (a tab character) means a PoC is unnecessary — but neither has any campaign leveraged this class of bug in the Fastify ecosystem historically.

Why not higher?

To reach HIGH, this bug would need to chain into a meaningful security breach — credential theft, RCE, or privilege escalation. The integrity-low impact ceiling blocks that: you can evade an IP check, but that alone does not compromise a host or exfiltrate data. The affected component is not a canonically high-value role (not a DC, hypervisor, or perimeter appliance), so the blast-radius floor does not elevate the verdict. No active exploitation or KEV listing provides additional upward pressure.

Why not lower?

Despite real friction, the vulnerability IS unauthenticated, network-accessible, and zero-interaction (AV:N/AC:L/PR:N/UI:N). IP-based security controls — especially rate limiting — are a real defensive layer that this bug weakens. Fastify's transitive dependency chain means millions of weekly installs carry the vulnerable code, even if only a subset are exploitable. Dropping below MEDIUM would understate the breadth of the dependency footprint and the ease of crafting the malicious header.

1. Switch reverse proxy to overwrite mode for X-Forwarded-For — Configure nginx with proxy_set_header X-Forwarded-For $remote_addr (not $proxy_add_x_forwarded_for), or ensure your cloud LB sets the header from the observed source IP. This eliminates attacker control over the header entirely. Deploy as part of the noisgate 365-day remediation window since no mitigation SLA applies for MEDIUM.
2. Add an onRequest hook to reject or normalize tabs in XFF — In your Fastify app, register a hook that strips \t characters from the X-Forwarded-For header before processing: fastify.addHook('onRequest', (req, reply, done) => { if (req.headers['x-forwarded-for']) req.headers['x-forwarded-for'] = req.headers['x-forwarded-for'].replace(/\t/g, ''); done(); }). This is the vendor-recommended workaround if you cannot immediately upgrade.
3. Upgrade @fastify/forwarded to 3.0.2 — The definitive fix. Run npm update @fastify/forwarded or pin >=3.0.2 in your lockfile. This is a patch-level semver bump with no breaking changes. Target completion within the noisgate 365-day remediation window.
4. Audit IP comparison logic for normalization — Grep your codebase for exact-string comparisons on request.ip (e.g., === '10.0.0.1'). Replace with parsed IP or CIDR comparison using net.isIP() or a library like ip-address. This hardens you against this class of bug regardless of the upstream parser.

Run this on any host where a Node.js application with @fastify/forwarded is deployed. Execute as the application user or any user with read access to node_modules. Example: bash check_cve_2026_18174.sh /opt/myapp

#!/usr/bin/env bash
# check_cve_2026_18174.sh — Detect CVE-2026-18174 in @fastify/forwarded
# Usage: bash check_cve_2026_18174.sh <path-to-node-project>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
PKG_NAME="@fastify/forwarded"
FIXED_VERSION="3.0.2"

if [ ! -d "$PROJECT_DIR/node_modules" ]; then
  echo "UNKNOWN — node_modules not found in $PROJECT_DIR"
  exit 2
fi

PKG_JSON="$PROJECT_DIR/node_modules/$PKG_NAME/package.json"

if [ ! -f "$PKG_JSON" ]; then
  echo "UNKNOWN — $PKG_NAME not installed in $PROJECT_DIR"
  exit 2
fi

INSTALLED=$(node -e "process.stdout.write(require('$PKG_JSON').version)" 2>/dev/null)
if [ -z "$INSTALLED" ]; then
  echo "UNKNOWN — could not read version from $PKG_JSON"
  exit 2
fi

# Compare versions using node semver logic
RESULT=$(node -e "
  const v = '$INSTALLED'.split('.').map(Number);
  const f = '$FIXED_VERSION'.split('.').map(Number);
  const cmp = v[0] - f[0] || v[1] - f[1] || v[2] - f[2];
  process.stdout.write(cmp >= 0 ? 'PATCHED' : 'VULNERABLE');
" 2>/dev/null)

if [ "$RESULT" = "PATCHED" ]; then
  echo "PATCHED — $PKG_NAME $INSTALLED >= $FIXED_VERSION (CVE-2026-18174)"
  exit 0
elif [ "$RESULT" = "VULNERABLE" ]; then
  echo "VULNERABLE — $PKG_NAME $INSTALLED < $FIXED_VERSION (CVE-2026-18174)"
  exit 1
else
  echo "UNKNOWN — version comparison failed for $INSTALLED"
  exit 2
fi

Sources

1. GHSA-2849-m2w7-xm8f — @fastify/forwarded advisory
2. @fastify/forwarded v3.0.1→v3.0.2 diff (fix commit)
3. Fastify GitHub — X-Forwarded-For spoofing issue #5865
4. @fastify/forwarded — npm package page
5. Snyk package health — @fastify/forwarded
6. RFC 7230 §3.2.3 — OWS definition (SP / HTAB)
7. CISA Known Exploited Vulnerabilities Catalog