CVE-2026-18174

Received Received - Intake

@fastify/forwarded IP Address Parsing Flaw via X-Forwarded-For

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: openjs

Description

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both space and tab. As a result, an entry padded with a tab keeps the literal tab in the resolved address string. Applications that make exact string match security decisions on the resolved client IP, such as an allowlist, a blocklist, a per IP rate limit key, or audit log correlation, can be evaded because the tab corrupted string no longer matches the expected value. This does not cross the trust boundary, since a tab corrupted string is not a valid IP and cannot be mistaken for a trusted proxy. The issue is fixed in @fastify/forwarded 3.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-18174

Affected Vendors & Products

Vendor	Product	Version / Range
fastify	forwarded	to 3.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

The vulnerability in @fastify/forwarded before version 3.0.2 involves improper parsing of the X-Forwarded-For header. When the header contains multiple comma-separated entries, the parser only trims spaces but not horizontal tabs. This causes the resolved client IP address to include a literal tab character, which can evade security checks like allowlists or blocklists that rely on exact string matching.

Detection Guidance

This vulnerability can be detected by checking the version of @fastify/forwarded in your system. If you are using a version before 3.0.2, your system is vulnerable. Run: npm list @fastify/forwarded to check the installed version.

Impact Analysis

If you use @fastify/forwarded before 3.0.2, an attacker could manipulate the X-Forwarded-For header to bypass IP-based security controls. For example, they might evade rate limits, IP allowlists, or blocklists by injecting a tab character into the header, causing the resolved IP to not match expected values.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access or bypassing security controls that rely on IP validation. For GDPR, it may affect data protection measures if IP-based access controls are evaded. For HIPAA, it could compromise audit log integrity if IP correlation fails due to tab corruption in resolved addresses.

Mitigation Strategies

Immediately update @fastify/forwarded to version 3.0.2 or later. Run: npm update @fastify/forwarded. If you cannot update, consider implementing strict validation of the X-Forwarded-For header to reject entries with tabs or unexpected whitespace.

Hi! I’m here to help you understand CVE-2026-18174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70