Skip to content
Fencer Vulns
medium 5.3

CVE-2026-18174 json

@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

published 2026-07-29 3 mo ago modified 2026-08-05 3 mo ago also EUVD-2026-50332

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both space and tab. As a result, an entry padded with a tab keeps the literal tab in the resolved address string. Applications that make exact string match security decisions on the resolved client IP, such as an allowlist, a blocklist, a per IP rate limit key, or audit log correlation, can be evaded because the tab corrupted string no longer matches the expected value. This does not cross the trust boundary, since a tab corrupted string is not a valid IP and cannot be mistaken for a trusted proxy. The issue is fixed in @fastify/forwarded 3.0.2.

Patch / fix

  • @fastify/forwarded @fastify/forwarded 3.0.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18174 updated cvss 5.3

@fastify/forwarded: @fastify/forwarded: Security policy bypass due to unstripped tab characters in X-Forwarded-For header

  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel9
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

  • @fastify/forwarded @fastify/forwarded

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-184 Incomplete List of Disallowed Inputs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.