Live › vulnerability › CVE-2026-120215
When @fastify/cors is registered with the non-default onSend hook, a single CORS preflight request makes the plugin re-send response headers, throwing an uncaught error. With no process-level error handler, this can terminate the Node.js process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 11:22 UTC. All times on this page are UTC.
Only Fastify applications that register @fastify/cors with the non-default onSend hook option are exposed. Applications using the default hook or without CORS preflight handling can skip it. The impact is availability only, and the crash needs no authentication.
No product ranges from the sources yet.
npm ls @fastify/cors; versions 8.2.0 through 11.3.x are in range.hook option to onSend.uncaughtException handler installed.@fastify/cors or later; in 11.4.0 is rejected at registration instead of crashing at request time.11.4.0onSendonRequest, or set preflight to false.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.
This page as .md · .json · in your agent: get_signal("CVE-2026-120215")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.