CVE-2026-75021 — fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable add…
Published: 2026-09-08 · CVSS: 8.1 · CVSS 3.1
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7