Description

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-08T13:17:24.010Z",
  "pubdate": "2026-09-08T13:17:24.010Z",
  "executiveSummary": "The fastify-cli utility is susceptible to an insecure configuration vulnerability where the Node.js Inspector interface is bound to an overly broad network address. When users initiate the tool with a debug flag, the application ignores explicit user-supplied bind addresses, defaulting to an interface accessible beyond the local loopback. This misconfiguration exposes the Node.js debugging protocol—which inherently permits arbitrary JavaScript code evaluation—to external network actors.\nThe impact of this vulnerability is critical, as it allows unauthenticated remote attackers to gain remote code execution (RCE) on the developer’s host machine. By interacting with the exposed debugging port, an attacker can inject and execute arbitrary code within the context of the running Node.js process. This vulnerability affects versions 1.5.0 through 8.0.1. The risk is particularly high in development environments where sensitive credentials or environment variables may be present. Exploitation does not require prior authentication, and the capability of the attacker is limited only by the privileges of the user running the fastify-cli process.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the fastify-cli command-line argument parsing and the subsequent spawning of the Node.js process. When the Inspector is enabled via the CLI, the application fails to correctly enforce the user-defined host binding configuration. Instead of restricting the Inspector interface to the localhost (127.0.0.1), the implementation defaults to binding to all available network interfaces (0.0.0.0) or an otherwise broader address, regardless of explicit user directives.\nThe Node.js Inspector protocol (based on the V8 Inspector Protocol) is designed to provide introspection and control over the runtime environment. It supports features such as heap snapshots, CPU profiling, and, most critically, the ability to execute arbitrary code through the Runtime.evaluate method. Because the protocol is not encrypted and lacks built-in authentication, binding this service to a non-local interface creates an immediate Remote Code Execution (RCE) vector.\nThe attack flow proceeds as follows: First, a target user executes fastify-cli with the debug flag in an environment where the interface is exposed to a network. Second, the vulnerable version of fastify-cli initializes the Node.js Inspector and incorrectly binds it to a globally reachable IP address. Third, an attacker, having identified the exposed port (typically 9229), initiates a connection to the debugging interface. Fourth, the attacker sends a JSON-RPC message containing a malicious JavaScript payload to the Runtime.evaluate endpoint. Finally, the target Node.js process executes the attacker's payload, granting the attacker arbitrary command execution under the security context of the user process.\nThis behavior affects fastify-cli versions ranging from 1.5.0 to 8.0.1. The vulnerability exists within the logic handling the initialization of the Node.js child process inspector flags. Successful exploitation results in full system access equivalent to the permissions of the application process, potentially allowing for the exfiltration of environment variables, source code, or internal network pivoting. No authentication is required to interact with the Inspector once it is reachable, making this a high-severity entry point for attackers targeting developer workstations or CI/CD pipelines."
}