What is CVE-2026-18174?
CVE-2026-18174 is a vulnerability in the @fastify/forwarded library where the parser, in versions before 3.0.2, fails to strip horizontal tabs from the X-Forwarded-For header, only trimming spaces, despite RFC 7230 defining optional whitespace as both. This affects IP address resolution and updating to the latest version is recommended.
Azərbaycanca: CVE-2026-18174, @fastify/forwarded kitabxanasında X-Forwarded-For başlığını emal edərkən RFC 7230 standartına uyğun olaraq yalnız boşluq simvollarını deyil, üfüqi tab (horizontal tab) simvollarını da nəzərə almaması ilə bağlı boşluqdur. Bu, 3.0.2-dən əvvəlki versiyalara təsir edir və müştəri IP ünvanının düzgün təyin edilməməsi ilə nəticələnə bilər. Kitabxananı ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-20
FAQ2
Which exact versions of @fastify/forwarded are affected by CVE-2026-18174?
All versions of the @fastify/forwarded library prior to 3.0.2 are affected by this vulnerability.
What is the root cause of CVE-2026-18174?
The vulnerability is caused by the parser failing to strip horizontal tab characters from the X-Forwarded-For header, only trimming space characters, even though RFC 7230 defines optional whitespace as both.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.