Every CVE Search/ Get API key

CVE-2026-92081

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

5.9 MediumFix available

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.41%Unchanged since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Record
CVE-2026-92081
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
EUVDEUVD-2026-80315 5.9

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Record
EUVD-2026-80315
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4mh8-r7rc-xpvc 5.9

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Record
GHSA-4mh8-r7rc-xpvc
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
NVD 5.9

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Record
CVE-2026-92081
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSV 5.9

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Record
CVE-2026-92081
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSVGHSA-4mh8-r7rc-xpvc 5.9

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Record
GHSA-4mh8-r7rc-xpvc
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
Show 9 moreShow less
OSVCLSA-2026-1791626840 No score

TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.5.

Record
CLSA-2026-1791626840
Updated
2026-11-02
OSVCLSA-2026-1791667117 No score

TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.0-tuxcare.5.

Record
CLSA-2026-1791667117
Updated
2026-11-02
OSVCLSA-2026-1791680737 No score

TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.1-tuxcare.3.

Record
CLSA-2026-1791680737
Updated
2026-11-02
OSVCLSA-2026-1791806519 No score

TuxCare security update for fastify (3 CVEs)

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.7.4-tuxcare.5.

Record
CLSA-2026-1791806519
Updated
2026-11-02
OSVCLSA-2026-1791839080 No score

TuxCare security update for fastify (3 CVEs)

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.11.3-tuxcare.6.

Record
CLSA-2026-1791839080
Updated
2026-11-02
OSVCLSA-2026-1792233310 No score

TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.6.

Record
CLSA-2026-1792233310
Updated
2026-11-02
OSVCLSA-2026-1792472724 No score

TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.4-tuxcare.1.

Record
CLSA-2026-1792472724
Updated
2026-11-02
OSVCLSA-2026-1793988537 No score

TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 3.29.5-tuxcare.8.

Record
CLSA-2026-1793988537
Updated
2026-11-07
OSVCLSA-2026-1794060794 No score

TuxCare security update for fastify (6 CVEs)

TuxCare rebuilt fastify to address 6 CVEs. Fixed in 4.28.1-tuxcare.1.

Record
CLSA-2026-1794060794
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fastify
npm
 before 5.12.5
5.12.5
fastify
TuxCare:npm
 4.29.1-tuxcare.0 up to 4.29.1-tuxcare.5, plus listed versions
4.29.14.29.1-tuxcare.14.29.1-tuxcare.24.29.1-tuxcare.34.29.1-tuxcare.4
4.29.1-tuxcare.5
fastify
TuxCare:npm
 5.12.0-tuxcare.0 up to 5.12.0-tuxcare.5, plus listed versions
5.12.05.12.0-tuxcare.15.12.0-tuxcare.25.12.0-tuxcare.35.12.0-tuxcare.4
5.12.0-tuxcare.5
fastify
TuxCare:npm
 5.12.1-tuxcare.0 up to 5.12.1-tuxcare.3, plus listed versions
5.12.15.12.1-tuxcare.15.12.1-tuxcare.2
5.12.1-tuxcare.3
fastify
TuxCare:npm
From an advisory covering 3 CVEs
 5.7.4-tuxcare.0 up to 5.7.4-tuxcare.5, plus listed versions
5.7.45.7.4-tuxcare.15.7.4-tuxcare.25.7.4-tuxcare.35.7.4-tuxcare.4
5.7.4-tuxcare.5
fastify
TuxCare:npm
From an advisory covering 3 CVEs
 5.11.3-tuxcare.0 up to 5.11.3-tuxcare.6, plus listed versions
5.11.35.11.3-tuxcare.15.11.3-tuxcare.25.11.3-tuxcare.35.11.3-tuxcare.45.11.3-tuxcare.5
5.11.3-tuxcare.6
fastify
TuxCare:npm
 5.2.1-tuxcare.0 up to 5.2.1-tuxcare.6, plus listed versions
5.2.15.2.1-tuxcare.15.2.1-tuxcare.25.2.1-tuxcare.35.2.1-tuxcare.45.2.1-tuxcare.5
5.2.1-tuxcare.6
fastify
TuxCare:npm
From an advisory covering 2 CVEs
 5.12.4-tuxcare.0 up to 5.12.4-tuxcare.1, plus listed versions
5.12.4
5.12.4-tuxcare.1
fastify
TuxCare:npm
 3.29.5-tuxcare.0 up to 3.29.5-tuxcare.8, plus listed versions
3.29.53.29.5-tuxcare.13.29.5-tuxcare.23.29.5-tuxcare.33.29.5-tuxcare.43.29.5-tuxcare.53.29.5-tuxcare.63.29.5-tuxcare.7
3.29.5-tuxcare.8
fastify
TuxCare:npm
From an advisory covering 6 CVEs
 4.28.1-tuxcare.0 up to 4.28.1-tuxcare.1, plus listed versions
4.28.1
4.28.1-tuxcare.1

History

History
RecordedChangedSources
affected, aliasesOSV
affected, aliasesOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92081 is a medium vulnerability (CVSS 5.9) in @clerk Fastify, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in fastify 5.12.5.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open