{"id":"CVE-2026-92081","kind":"vulnerability","aliases":["CVE-2026-92081","GHSA-4mh8-r7rc-xpvc"],"related":[],"title":"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses","description":"### Impact\r\n\r\n`fastify` crashes with an uncaught `ERR_HTTP2_INVALID_CONNECTION_HEADERS` exception when a route that registers a response trailer via `reply.trailer()` is served over HTTP/2. Fastify unconditionally adds the `Transfer-Encoding: chunked` header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.\r\n\r\nOne unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (`http2: true`) and at least one route registers a trailer. HTTP/1.x responses are not affected.\r\n\r\n### Patches\r\n\r\nUpgrade to `fastify` `5.12.5`, `4.29.2`, or later.\r\n\r\n### Workarounds\r\n\r\nAvoid registering response trailers with `reply.trailer()` on routes served over HTTP/2 until upgrading.","summary":"Fastify adds a forbidden Transfer-Encoding header to HTTP/2 responses that use reply.trailer(), so Node.js throws an uncaught exception and the process exits. One unauthenticated HTTP/2 request to such a route is enough to take the server down, and it can be repeated.","severity":"medium","cvss":5.9,"epss":0.00412,"exploited":false,"exploited_at":null,"products":[{"name":"fastify","fixed":["5.12.5"],"affected":"< 5.12.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-248","fastify","http2","node","npm","package"],"not_affected_if":["http2-disabled","no-response-trailers"],"how_to_check":"- Check the installed version: `npm ls fastify`\n- Confirm HTTP/2 is on: look for `http2: true` in the Fastify server options\n- Search the code for `reply.trailer(` on routes served over HTTP/2","fix":"- `fastify` `5.12.5` (5.x line)\n- `fastify` `4.29.2` (4.x line)\n- Workaround until upgrading: avoid `reply.trailer()` on routes served over HTTP/2","status":"open","published_at":"2026-09-16T07:38:07+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","triaged_at":"2026-11-09T23:01:05+00:00","updated_at":"2026-11-09T23:01:05+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T23:01:05Z","model":"claude-haiku-5-5","output":{"fix":"- `fastify` `5.12.5` (5.x line)\n- `fastify` `4.29.2` (4.x line)\n- Workaround until upgrading: avoid `reply.trailer()` on routes served over HTTP/2","reach":"internet","title":"Fastify: unauthenticated HTTP/2 request crashes the Node.js process","impact":"low","summary":"Fastify adds a forbidden Transfer-Encoding header to HTTP/2 responses that use reply.trailer(), so Node.js throws an uncaught exception and the process exits. One unauthenticated HTTP/2 request to such a route is enough to take the server down, and it can be repeated.","audience":"developers","category":"package","nicknames":[],"who_cares":["fastify","node","http2","npm"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated requests crash the server process, dropping all in-flight requests","analyst_note":"","how_to_check":"- Check the installed version: `npm ls fastify`\n- Confirm HTTP/2 is on: look for `http2: true` in the Fastify server options\n- Search the code for `reply.trailer(` on routes served over HTTP/2","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["http2-disabled","no-response-trailers"],"who_is_affected":"Only apps that run Fastify with HTTP/2 enabled (`http2: true`) and at least one route that calls `reply.trailer()`. HTTP/1.x responses are not affected. Apps on HTTP/1.x only, or with no trailers, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000806,"input_tokens":4993,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A '-248':27B '-92081':16A,24A '4.29.2':204C '4mh8':19A '5.12.5':203C 'add':34B,105C 'affect':178C,198C 'applic':176C 'avoid':208C 'becom':136C 'caught':134C 'chunk':110C 'connect':86C 'crash':79C,156C 'cve':14A,22A 'cwe':26B 'denial':4A 'drop':159C 'enabl':183C 'encod':39B,109C 'enough':66B,154C 'err':83C 'except':9A,52B,88C,131C 'exit':56B 'fastifi':1A,28B,33B,78C,103C,202C 'fastify':25A 'flight':163C 'forbidden':36B,119C 'ghsa':18A 'ghsa-4mh8-r7rc-xpvc':17A 'header':40B,87C,111C,129C 'http/1.x':194C 'http/2':11A,42B,59B,102C,121C,145C,181C,218C 'http2':29B,84C,184C 'impact':77C 'in-flight':161C 'invalid':85C 'keep':172C 'later':206C 'least':188C 'node':30B 'node.js':48B,123C,141C 'npm':31B 'one':57B,143C,189C 'packag':32B 'patch':199C 'process':55B,142C,174C 'r7rc':20A 'regist':93C,191C,209C 'repeat':76B,170C 'reply.trailer':46B,98C,213C 'request':60B,146C,164C,167C 'respons':13A,43B,95C,128C,195C,210C 'rout':64B,91C,149C,190C,215C 'serial':126C 'serv':100C,216C 'server':70B,158C 'servic':6A 'set':116C 'take':68B 'termin':139C 'throw':49B,124C 'trailer':12A,96C,114C,152C,193C,211C 'transfer':38B,108C 'transfer-encod':37B,107C 'true':185C 'unauthent':58B,144C 'uncaught':51B,82C 'uncaughtexcept':138C 'uncondit':104C 'unhandl':8A 'upgrad':200C,220C 'use':45B,151C 'via':7A,97C 'vulner':2A 'workaround':207C 'xpvc':21A","nicknames":[],"mitigations":[],"who_affected":"Only apps that run Fastify with HTTP/2 enabled (`http2: true`) and at least one route that calls `reply.trailer()`. HTTP/1.x responses are not affected. Apps on HTTP/1.x only, or with no trailers, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["fastify"],"ptokens":["fastify"],"labels":["cwe248","fastify","http2","medium","node","npm","package"],"campaign_type":null,"search_a":"'-2026':15A,23A '-92081':16A,24A '4mh8':19A 'cve':14A,22A 'denial':4A 'except':9A 'fastifi':1A 'fastify':25A 'ghsa':18A 'ghsa-4mh8-r7rc-xpvc':17A 'http/2':11A 'r7rc':20A 'respons':13A 'servic':6A 'trailer':12A 'unhandl':8A 'via':7A 'vulner':2A 'xpvc':21A","search_b":"'-248':27B 'add':34B 'cwe':26B 'encod':39B 'enough':66B 'except':52B 'exit':56B 'fastifi':28B,33B 'forbidden':36B 'header':40B 'http/2':42B,59B 'http2':29B 'node':30B 'node.js':48B 'npm':31B 'one':57B 'packag':32B 'process':55B 'repeat':76B 'reply.trailer':46B 'request':60B 'respons':43B 'rout':64B 'server':70B 'take':68B 'throw':49B 'transfer':38B 'transfer-encod':37B 'unauthent':58B 'uncaught':51B 'use':45B","search_c":"'4.29.2':204C '5.12.5':203C 'add':105C 'affect':178C,198C 'applic':176C 'avoid':208C 'becom':136C 'caught':134C 'chunk':110C 'connect':86C 'crash':79C,156C 'drop':159C 'enabl':183C 'encod':109C 'enough':154C 'err':83C 'except':88C,131C 'fastifi':78C,103C,202C 'flight':163C 'forbidden':119C 'header':87C,111C,129C 'http/1.x':194C 'http/2':102C,121C,145C,181C,218C 'http2':84C,184C 'impact':77C 'in-flight':161C 'invalid':85C 'keep':172C 'later':206C 'least':188C 'node.js':123C,141C 'one':143C,189C 'patch':199C 'process':142C,174C 'regist':93C,191C,209C 'repeat':170C 'reply.trailer':98C,213C 'request':146C,164C,167C 'respons':95C,128C,195C,210C 'rout':91C,149C,190C,215C 'serial':126C 'serv':100C,216C 'server':158C 'set':116C 'termin':139C 'throw':124C 'trailer':96C,114C,152C,193C,211C 'transfer':108C 'transfer-encod':107C 'true':185C 'unauthent':144C 'uncaught':82C 'uncaughtexcept':138C 'uncondit':104C 'upgrad':200C,220C 'use':151C 'via':97C 'workaround':207C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-16T07:38:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-4mh8-r7rc-xpvc","url":"https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc","severity":"medium","published_at":"2026-09-16T07:38:07+00:00","modified_at":"2026-09-16T07:38:07+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","fetched_at":"2026-11-09T22:53:17+00:00","note":null},{"source":"ghsa","external_id":"GHSA-4mh8-r7rc-xpvc","url":"https://github.com/advisories/GHSA-4mh8-r7rc-xpvc","severity":"medium","published_at":"2026-09-30T23:53:44+00:00","modified_at":"2026-09-30T23:53:45+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-92081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92081","severity":null,"published_at":"2026-09-16T09:17:10+00:00","modified_at":"2026-09-16T19:40:00+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110462,"url":"https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-16T07:38:07+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110791,"url":"https://api.github.com/repos/fastify/fastify/security-advisories/GHSA-4mh8-r7rc-xpvc","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110793,"url":"https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110794,"url":"https://github.com/fastify/fastify/releases/tag/v5.12.5","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00412,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92081"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}