CVE-2026-75021: fastify-cli debug-host bind can expose Inspector RCE

You asked the Inspector to stay on loopback. Operator precedence put it on every interface instead. fastify-cli 1.5.0 through 8.0.0 starts Node's Inspector when debug mode is on, but the host selection expression is grouped wrong. Because || binds tighter than ?:, any truthy --debug-host (including 127.0.0.1) collapses into the Docker/Kubernetes branch and binds 0.0.0.0. The Inspector is an unauthenticated code-eval interface. If that port is reachable, a remote party can attach Chrome DevTools Protocol and run OS commands as the Fastify process.

Upgrade to fastify-cli 8.0.1. Debug mode is off by default. This is not a Fastify framework core bug.

What breaks

GitHub advisory GHSA-88v4-3ph7-r88m / CVE-2026-75021 rates this High CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Complexity is high: debug mode must be on, an explicit debug host must be set, and the Inspector port (default 9320) must be reachable.

In affected start.js (shown from 8.0.0) the host argument is:

require('node:inspector').open(
  opts.debugPort,
  opts.debugHost || isDocker() || isKubernetes() ? listenAddressDocker : undefined
)

Because || binds tighter than ?:, that parses as (opts.debugHost || isDocker() || isKubernetes()) ? '0.0.0.0' : undefined (where listenAddressDocker is 0.0.0.0). Any truthy opts.debugHost therefore selects the Docker/Kubernetes branch.

The README documents that Docker/Kubernetes default the Inspector host to 0.0.0.0. Operators pass --debug-host 127.0.0.1 or FASTIFY_DEBUG_HOST=127.0.0.1 to tighten that. Broken builds ignore the intended loopback and still bind every interface.

8.0.1 fixes the grouping with nullish coalescing:

require('node:inspector').open(
  opts.debugPort,
  opts.debugHost ?? (isDocker() || isKubernetes() ? listenAddressDocker : undefined)
)

Affected: >=1.5.0 <8.0.1. Fixed: 8.0.1 (npm updated 2026-09-07). CVE published 2026-09-08. GHSA published 2026-09-07.

Who is not in scope

• Processes that never enable CLI debug (-d / --debug / FASTIFY_DEBUG).
• Apps that do not use fastify-cli start.
• Installations already on fastify-cli 8.0.1 or newer.
• The Fastify framework package itself (this is CLI host selection only).

How to check

From the project root:

npm ls fastify-cli
npx fastify version

If debug is enabled, confirm what the Inspector bound:

ss -lntp | grep 9320
# or: lsof -iTCP:9320 -sTCP:LISTEN

If you passed --debug-host 127.0.0.1 (or set FASTIFY_DEBUG_HOST=127.0.0.1) but still see 0.0.0.0:9320, the install is broken.

How to fix

Upgrade the CLI:

npm install [email protected]

Until you can patch: do not enable --debug on remotely reachable hosts, and firewall the Inspector port.

What this is not

This is not an unauthenticated RCE on a default Fastify production listen. Debug mode must be turned on, and the widened bind only shows up when an explicit debug host is supplied. It is not a vuln in fastify core request handling.

References

• GHSA-88v4-3ph7-r88m
• HOL Guard evidence pack for CVE-2026-75021