What’s Vulnerable › Vulnerabilities

CVE-2026-75021: fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-08 · updated 2026-09-08
• Weakness: CWE-1327

Description

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

Affected products

• fastify-cli: from 1.5.0 before 8.0.1 — fixed in 8.0.1

How to fix

Upgrade to a fixed version: fastify-cli 8.0.1. Check the vendor advisory for mitigations.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-cli/security/advisories/GHSA-88v4-3ph7-r88m

Get alerted when CVE-2026-75021 or the next vulnerability affects your stack