# CVE-2026-75021

## Summary

- **CVE ID:** CVE-2026-75021
- **Severity:** HIGH
- **CVSS Score:** 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-1327
- **Published:** Sep 8, 2026
- **Last Modified:** Sep 8, 2026

## Description

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

## Affected Products

- fastify-cli — fastify-cli (1.5.0)
- fastify-cli — fastify-cli (8.0.1)

## References

- [CNA](https://github.com/fastify/fastify-cli/security/advisories/GHSA-88v4-3ph7-r88m)
- [CNA](https://cna.openjsf.org/security-advisories.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.42%
- **EPSS Percentile:** 35.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._