npm fastify-cli vulnerabilities

Latest npm fastify-cli CVEs

Newest publication first

1. CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

   Published 2026-09-08

   High·CVSS 8.1 EPSS 0.71%

   fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the lo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.