CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address
Attackers can achieve remote code execution on developer machines because the CLI ignores Inspector bind address settings, exposing the debugging interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75021?
CVE-2026-75021 is a high-severity vulnerability in fastify-cli, published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.
Weakness: CWE-1327
Which versions are affected by CVE-2026-75021?
How do I fix CVE-2026-75021?
No fix has been published for CVE-2026-75021 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-75021 being exploited?
There is no known exploitation of CVE-2026-75021 in the wild and no public exploit code.
Sources
Also known as GHSA-88v4-3ph7-r88m.