CVE-2026-75021: fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fastify-clito a version that resolves this vulnerability.Fixed in 8.0.1 - Configuration
When using the debug flag, ensure fastify-cli honors the explicit Inspector bind address so the Inspector is bound only to the intended address (e.g., loopback) rather than a broadly reachable address.
fastify-cli (Node.js Inspector launched via debug flag) Inspector bind address (explicit bind address provided by the user) = honor configured Inspector bind address
Event History
Frequently Asked Questions
Which environments are realistically exposed to remote code execution?
Systems running fastify-cli with a debug flag and an explicitly configured Inspector bind address intended to restrict access to loopback are exposed if the Inspector becomes reachable beyond the local machine. The impact is on the developer's machine running the CLI.
What does an attacker need to exploit this issue?
An attacker needs network reachability to the exposed Node.js Inspector interface. Once they can reach it, the Inspector protocol permits arbitrary code evaluation, enabling remote code execution.
What is the recommended remediation?
Upgrade fastify-cli to version 8.0.1, which honors the configured Inspector bind address. The affected range is reported as fastify-cli 1.5.0 up to 8.0.1.