CVE-2026-75021: fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

Published Sep 8, 2026
·
Updated

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

Affected Software

1 affected component
npm/fastify-cli>1.5.0<=8.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade fastify-cli to a version that resolves this vulnerability.

    Fixed in 8.0.1
  2. Configuration

    When using the debug flag, ensure fastify-cli honors the explicit Inspector bind address so the Inspector is bound only to the intended address (e.g., loopback) rather than a broadly reachable address.

    fastify-cli (Node.js Inspector launched via debug flag) Inspector bind address (explicit bind address provided by the user) = honor configured Inspector bind address

Event History

Sep 8, 2026
CVE Published
via MITRE·12:50 PM
Data Sourced
via MITRE·12:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which environments are realistically exposed to remote code execution?

Systems running fastify-cli with a debug flag and an explicitly configured Inspector bind address intended to restrict access to loopback are exposed if the Inspector becomes reachable beyond the local machine. The impact is on the developer's machine running the CLI.

2

What does an attacker need to exploit this issue?

An attacker needs network reachability to the exposed Node.js Inspector interface. Once they can reach it, the Inspector protocol permits arbitrary code evaluation, enabling remote code execution.

3

What is the recommended remediation?

Upgrade fastify-cli to version 8.0.1, which honors the configured Inspector bind address. The affected range is reported as fastify-cli 1.5.0 up to 8.0.1.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203