fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-75021 is a critical vulnerability in fastify-cli versions 1.5.0 through 8.0 that exposes the Node.js Inspector debugging interface to the network despite user-supplied loopback binding configurations. When developers enable debug mode, the Inspector protocol—which permits arbitrary code execution—becomes accessible remotely rather than restricted to localhost. This is particularly dangerous because developers often run CLI tools on machines with network access, turning a local debugging convenience into a remote code execution vector. Organizations using fastify-cli in development environments face direct risk of compromised developer machines, which can serve as entry points to internal networks and repositories.
While this CVE shows zero matches in Casky's current 754 MITRE ATT&CK-mapped skills, the underlying attack pattern would be detected through reconnaissance and lateral movement detection capabilities. A practitioner leveraging Casky's extended reasoning across Claude AI would identify this as an Execution technique (T1203 - Exploitation for Client Execution) combined with network discovery of exposed debug services. Detection would surface anomalous network connections to non-standard debug ports, unexpected Node.js process execution with debug flags, and outbound connections from development machines to suspicious external IPs. While the current skill mapping lacks fastify-specific coverage, Casky's reasoning engine could correlate suspicious Inspector protocol traffic patterns with CWE-1327 (Improper Control of Dynamically-Managed Code Resources) to alert practitioners to this class of exposure before exploitation occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-75021. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation