Summary
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
Advisory details
Impact
fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.
One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.
Patches
Upgrade to fastify 5.12.5 or later.
Workarounds
Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
References
- https://github.com/advisories/GHSA-4mh8-r7rc-xpvc
- https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc
- https://nvd.nist.gov/vuln/detail/CVE-2026-92081
- https://github.com/fastify/fastify/issues/6574
- https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify/releases/tag/v5.12.5
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-84994
Qwik: Crashing any Qwik Server via Resource thenable
- MEDIUMCVE-2026-100347
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
- HIGHCVE-2026-97394
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
- MEDIUMCVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
- MEDIUMCVE-2026-107392
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
- HIGHCVE-2026-107214
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks