AIKIDO-2026-60639

TL;DR

The @fastify/forwarded package resolves client addresses from the X-Forwarded-For header by trimming optional whitespace around comma-separated entries. The parser strips space characters but not horizontal tabs, so an entry padded with a leading or trailing tab keeps the literal tab in the resolved address string. Applications that make exact-string-match security decisions on the resolved client IP, such as allowlists, blocklists, per-IP rate-limit keys, or audit-log correlation, can be evaded when untrusted input inserts a tab before an address, because the resolved string no longer matches the expected value. The fix treats a horizontal tab as optional whitespace alongside space when trimming entries.