GHSA-4mh8-r7rc-xpvc CVE-2026-92081
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
- Severity
- 5.9 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.41%
- Chance of exploitation in the next 30 days. Higher than 35.50% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-248 Uncaught Exception
- Fix
5.12.5- Upgrade fastify to this version or later
Description
Impact
fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.
One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.
Patches
Upgrade to fastify 5.12.5 or later.
Workarounds
Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| fastify | < 5.12.5 |
5.12.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fastify npm → 5.12.5
- npm
npm install fastify@5.12.5- yarn
yarn add fastify@5.12.5- pnpm
pnpm add fastify@5.12.5
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-389g-gv7q-r4x8 fastify is vulnerable to header validation bypass via case-sensitive propertyNames | Low | Also affects fastify |
| GHSA-9q9j-q6p8-xq58 fastify vulnerable to header validation bypass via incomplete schema case normalization | High | Also affects fastify |
| GHSA-667r-xxjv-c9mm fastify vulnerable to request body replacement via an async validation result collision | High | Also affects fastify |
| GHSA-hwr6-493r-vm6h fastify vulnerable to request validation bypass via skipped boolean false schemas | High | Also affects fastify |
| GHSA-p68q-wchp-6fh7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers | High | Also affects fastify |
| GHSA-w2qp-rph6-63g4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch | Medium | Also affects fastify |
| GHSA-3m5p-2c4r-xxw2 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count | Medium | Also affects fastify |
| GHSA-444r-cwp2-x5xf fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections | Medium | Also affects fastify |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor