CyberRota Analysis
AI-GeneratedThe fastify-cli tool is vulnerable due to its failure to respect the user's specified bind address for the Node.js Inspector when a debug flag is enabled, inadvertently exposing the debugging interface to external access. This oversight allows remote attackers to execute arbitrary code on the developer's machine, posing a significant security risk. Developers using fastify-cli versions 1.5.0 to 8.0.1 should prioritize upgrading to version 8.0.1 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.