CVE-2026-75021

fastify-cli, the command-line launcher for the Fastify framework, starts the Node.js Inspector when a debug flag is used, but on affected versions it ignores the bind address the user explicitly supplies and binds the debugger to a broadly reachable address instead of loopback only. The flaw is triggered whenever an application is started through fastify-cli with the Inspector/debug option on versions 1.5.0 up to 8.0.1 and the debugger port is reachable from another host, such as on a shared network, a container with the debug port published, or a cloud development machine. Because the Node.js Inspector protocol allows arbitrary code evaluation, an attacker who can reach the exposed debugging interface gains remote code execution with the privileges of the Node.js process on that machine. Developers and teams running fastify-cli 1.5.0 up to 8.0.1 with debug flags are affected, with the greatest risk on hosts where the debugger port is not firewalled. No public proof-of-concept is known, the issue is not listed in CISA KEV, and EPSS estimates roughly a 0.4% chance of exploitation within 30 days.

What to do: Upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address. As an interim mitigation, avoid running fastify-cli with debug flags on network-reachable hosts, or firewall the Node Inspector port (default 9229) so it is not listening on a non-loopback interface. Check listeners on the Inspector port in shared, containerized, and remote development environments before upgrading.