CVE-2026-75021

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in Fastify CLI Debug Mode

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: openjs

Description

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-75021

Affected Vendors & Products

Vendor	Product	Version / Range
fastify	fastify-cli	From 1.5.0 (inc) to 8.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1327	The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

Attack-Flow Graph

Executive Summary

This vulnerability involves fastify-cli starting the Node.js Inspector with a debug flag but ignoring the user-specified bind address. Instead, it binds the Inspector to a broadly reachable address, exposing the debugging interface beyond the local machine. Since the Inspector protocol allows arbitrary code evaluation, a remote attacker could exploit this to execute code on the developer's machine.

Detection Guidance

Check if fastify-cli versions between 1.5.0 and 8.0.1 are installed. Run 'npm list fastify-cli' to verify the version. Inspect network bindings when using the debug flag by running 'netstat -tulnp | grep <port>' or 'ss -tulnp | grep <port>' to see if the Inspector binds to a broadly reachable address instead of localhost.

Impact Analysis

If you use fastify-cli versions 1.5.0 to 8.0.1 with the debug flag, an attacker on the same network could gain remote code execution on your machine. This could lead to unauthorized access, data theft, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, potentially violating GDPR's data protection requirements or HIPAA's security rules. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade fastify-cli to version 8.0.1 or later using 'npm install -g fastify-cli@latest'. Avoid using the debug flag in untrusted environments. If immediate upgrade is not possible, restrict network access to the debugging port using firewall rules.

Hi! I’m here to help you understand CVE-2026-75021. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70