CVE-2026-75021: fastify-cli, заобикаляне на вход и права

Описание

Оригинално описание

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

Засегнати продукти

• fastify-cli fastify-cli: 1.5.0 преди 8.0.1; 8.0.1

Вид слабост

• CWE-1327 Binding to an Unrestricted IP Address

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-75021
• https://nvd.nist.gov/vuln/detail/CVE-2026-75021
• https://github.com/fastify/fastify-cli/security/advisories/GHSA-88v4-3ph7-r88m
• https://cna.openjsf.org/security-advisories.html