{"id":"CVE-2026-120216","kind":"vulnerability","aliases":["CVE-2026-120216"],"related":[],"title":"Fastify: slow streaming responses crash the Node.js process after a timeout","description":"fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.","summary":"Fastify, a Node.js web framework, crashes the whole server process when a streaming response stays open past the configured handlerTimeout. An unauthenticated remote client can take the server down with a single request, interrupting other in-flight requests.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fastify","node.js","package","self-hosted","web-api"],"not_affected_if":["default-config","fastify-5.12.8-or-later","fastify-below-5.8.0","no-streaming-routes"],"how_to_check":"- Check the installed Fastify version with `npm ls fastify` and look for versions from `5.8.0` through `5.12.7`.\n- Search the server configuration for `handlerTimeout` and confirm whether it is set to a nonzero value.\n- Look for routes that return streaming responses.","fix":"- fastify: upgrade to `5.12.8` or later\n- Workaround stated in the sources: set `handlerTimeout` to `0`","status":"open","published_at":"2026-11-02T11:17:31+00:00","first_seen_at":"2026-11-02T11:22:54+00:00","triaged_at":"2026-11-02T11:24:16+00:00","updated_at":"2026-11-02T11:24:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-02T11:24:16Z","model":"claude-haiku-5-5","output":{"fix":"- fastify: upgrade to `5.12.8` or later\n- Workaround stated in the sources: set `handlerTimeout` to `0`","reach":"internet","title":"Fastify: slow streaming responses crash the Node.js process after a timeout","impact":"low","summary":"Fastify, a Node.js web framework, crashes the whole server process when a streaming response stays open past the configured handlerTimeout. An unauthenticated remote client can take the server down with a single request, interrupting other in-flight requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["fastify","node.js","self-hosted","web-api"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote unauthenticated request crashes the Node.js process, interrupting other requests","analyst_note":"","how_to_check":"- Check the installed Fastify version with `npm ls fastify` and look for versions from `5.8.0` through `5.12.7`.\n- Search the server configuration for `handlerTimeout` and confirm whether it is set to a nonzero value.\n- Look for routes that return streaming responses.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","no-streaming-routes","fastify-below-5.8.0","fastify-5.12.8-or-later"],"who_is_affected":"Only applications running Fastify 5.8.0 through 5.12.7 with a nonzero handlerTimeout and at least one route that returns a streaming response are exposed. The default handlerTimeout of 0 is not affected, so applications using default settings can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4328,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120216':14A,17A '-2026':13A,16A '0':188C,213C '5.12.7':77C '5.12.8':198C,204C '5.8.0':75C 'affect':164C,191C,217C 'alreadi':99C,129C 'api':26B 'avail':171C 'client':50B,154C 'configur':45B,82C 'crash':5A,32B,109C 'cve':12A,15A 'default':179C,185C 'disabl':215C 'endpoint':166C 'err':134C 'error':122C 'exploit':174C 'fastifi':1A,18B,27B,66C,116C,197C 'fire':115C 'fix':195C 'flight':64B,149C 'framework':31B,70C 'handlertimeout':46B,86C,180C,186C,211C 'header':102C,136C 'host':23B 'http':135C 'impact':169C 'in-flight':62B,147C 'interrupt':60B,144C 'issu':193C 'later':206C 'new':121C 'node.js':7A,19B,29B,72C,141C 'non':178C 'non-default':177C 'nonzero':85C 'open':42B,105C 'packag':20B 'past':43B,106C 'path':219C 'process':8A,36B,142C 'rais':131C 'remot':49B,153C 'request':59B,65B,95C,150C,161C 'requir':175C 'respons':4A,40B,93C,123C,126C 'return':90C 'rout':89C 'self':22B 'self-host':21B 'send':119C 'sent':100C,137C 'server':35B,54B,80C,111C 'set':183C,210C 'singl':58B,160C 'slow':2A 'start':130C 'stay':41B,104C 'stream':3A,39B,92C,97C,165C 'take':52B 'termin':139C 'timeout':11A,108C,114C,218C 'tri':117C 'trigger':156C 'unauthent':48B,152C 'uncaught':133C 'upgrad':202C 'user':200C 'version':74C 'web':25B,30B,69C 'web-api':24B 'whole':34B 'whose':96C 'workaround':209C","nicknames":[],"mitigations":[],"who_affected":"Only applications running Fastify 5.8.0 through 5.12.7 with a nonzero handlerTimeout and at least one route that returns a streaming response are exposed. The default handlerTimeout of 0 is not affected, so applications using default settings can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fastify","medium","nodejs","package","selfhosted","webapi"],"first_public_at":"2026-11-02T10:49:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120216","severity":null,"published_at":"2026-11-02T11:17:31+00:00","modified_at":"2026-11-02T11:17:31+00:00","first_seen_at":"2026-11-02T11:22:54+00:00","fetched_at":"2026-11-02T11:22:54+00:00","note":null}],"documents":[{"id":51569,"url":"https://github.com/fastify/fastify/security/advisories/GHSA-3qgw-9275-xf8w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T10:49:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}