{"action":"Upgrade fastify to 5.12.1 or later.","affected":[{"fixed":"5.12.1","introduced":"5.8.3"}],"component":"fastify","cve_ids":["CVE-2026-16732"],"ecosystem":"npm","epss":0.00158,"exploited":false,"fixed_versions":["5.12.1"],"ghsa_id":"GHSA-3m5p-2c4r-xxw2","id":"tcs_01M5KEXPJ3D0TH7YJTM76H0HQ6","modified_at":"2026-09-02T15:30:17.627342577Z","published_at":"2026-09-02T15:14:06Z","references":["https://osv.dev/vulnerability/GHSA-3m5p-2c4r-xxw2","https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2","https://nvd.nist.gov/vuln/detail/CVE-2026-16732","https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify","https://github.com/fastify/fastify/releases/tag/v5.12.1"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-3m5p-2c4r-xxw2","url":"https://osv.dev/vulnerability/GHSA-3m5p-2c4r-xxw2"}],"summary":"fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count"}