Packages / fastify / Security

ModerateVulnerabilityGHSA-4mh8-r7rc-xpvcCVE-2026-92081Published 30 Sep 2026

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Affected releases · fastify

  • 5.x5.0.0 – 5.12.4Fixed in 5.12.5
  • 4.x and older0.0.1 – 4.29.1No fix, no longer updated

On 5.x, the newest line:

npm install fastify@5.12.5
5.x

  1. Affected

    5.0.0 – 5.12.4

    36 releases

  2. Fixed

    5.12.5 – 5.12.7

    3 releases, latest

4.x

  1. Affected

    4.0.0 – 4.29.1

    61 releases

3.x

  1. Affected

    3.0.0 – 3.29.5

    71 releases

2.x

  1. Affected

    2.0.0 – 2.15.3

    25 releases

1.x

  1. Affected

    1.0.0 – 1.14.6

    31 releases

0.x

  1. Affected

    0.0.1 – 0.43.0

    73 releases

300 stable releases of fastify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for fastify. It is read in your browser and sent nowhere.

What happens

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.