CVE-2026-75021

    Dashboard / Vulnerabilities / CVE-2026-75021

    CVE-2026-75021

    Published: 8 Sept 2026Last Modified: 10 Sept 2026

    Summary: fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

    Details: fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

    References: https://cna.openjsf.org/security-advisories.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75021.json, https://github.com/fastify/fastify-cli/security/advisories/GHSA-88v4-3ph7-r88m, https://nvd.nist.gov/vuln/detail/CVE-2026-75021

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 84409825f494664ac9fe74f696ade1571e7ce2cc
    Fixed -a710b450301c87203097758250fac456d09c1acb

    Affected versions

    v8.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-75021 | CVE-DB