FASTIFY · CVE-2026-92081 · Package
FIX → 5.12.5
Fastify adds a forbidden Transfer-Encoding header to HTTP/2 responses that use reply.trailer(), so Node.js throws an uncaught exception and the process exits. One unauthenticated HTTP/2 request to such a route is enough to take the server down, and it can be repeated.
first public Sep 16, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only apps that run Fastify with HTTP/2 enabled (http2: true) and at least one route that calls reply.trailer(). HTTP/1.x responses are not affected. Apps on HTTP/1.x only, or with no trailers, can skip it.
Not affected if http2-disabled, no-response-trailers
Who cares fastify, http2, node, npm
npm ls fastifyhttp2: true in the Fastify server optionsreply.trailer( on routes served over HTTP/2Upgrade to 5.12.5
fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.
One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.
Upgrade to fastify 5.12.5, 4.29.2, or later.
Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
fastify5.12.5fastify 4.29.2 (4.x line)reply.trailer() on routes served over HTTP/2This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.