{"id":"CVE-2026-92081","aliases":["CLSA-2026-1791626840","CLSA-2026-1791667117","CLSA-2026-1791680737","CLSA-2026-1791806519","CLSA-2026-1791839080","CLSA-2026-1792233310","CLSA-2026-1792472724","CLSA-2026-1793988537","CLSA-2026-1794060794","EUVD-2026-80315","GHSA-4mh8-r7rc-xpvc"],"status":"published","title":"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses","description":"fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00412,"percentile":0.35751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2026-09-16T08:52:49Z","modified":"2026-11-07T19:00:36Z","fixes":[{"ecosystem":"npm","package":"fastify","fixed_in":["5.12.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fastify","fixed_in":["4.29.1-tuxcare.5","5.12.0-tuxcare.5","5.12.1-tuxcare.3","5.2.1-tuxcare.6","3.29.5-tuxcare.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.29.1-tuxcare.0"},{"fixed":"4.29.1-tuxcare.5"}]}],"versions":["4.29.1","4.29.1-tuxcare.1","4.29.1-tuxcare.2","4.29.1-tuxcare.3","4.29.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.0-tuxcare.0"},{"fixed":"5.12.0-tuxcare.5"}]}],"versions":["5.12.0","5.12.0-tuxcare.1","5.12.0-tuxcare.2","5.12.0-tuxcare.3","5.12.0-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.1-tuxcare.0"},{"fixed":"5.12.1-tuxcare.3"}]}],"versions":["5.12.1","5.12.1-tuxcare.1","5.12.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.4-tuxcare.0"},{"fixed":"5.7.4-tuxcare.5"}]}],"versions":["5.7.4","5.7.4-tuxcare.1","5.7.4-tuxcare.2","5.7.4-tuxcare.3","5.7.4-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.3-tuxcare.0"},{"fixed":"5.11.3-tuxcare.6"}]}],"versions":["5.11.3","5.11.3-tuxcare.1","5.11.3-tuxcare.2","5.11.3-tuxcare.3","5.11.3-tuxcare.4","5.11.3-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.6"}]}],"versions":["5.2.1","5.2.1-tuxcare.1","5.2.1-tuxcare.2","5.2.1-tuxcare.3","5.2.1-tuxcare.4","5.2.1-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.4-tuxcare.0"},{"fixed":"5.12.4-tuxcare.1"}]}],"versions":["5.12.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.29.5-tuxcare.0"},{"fixed":"3.29.5-tuxcare.8"}]}],"versions":["3.29.5","3.29.5-tuxcare.1","3.29.5-tuxcare.2","3.29.5-tuxcare.3","3.29.5-tuxcare.4","3.29.5-tuxcare.5","3.29.5-tuxcare.6","3.29.5-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.1-tuxcare.0"},{"fixed":"4.28.1-tuxcare.1"}]}],"versions":["4.28.1"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"fastify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.12.5"}]}]}],"products":[{"vendor":"@clerk","product":"fastify"},{"vendor":"fastify","product":"fastify"}],"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc","tags":["advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92081","tags":["advisory"]},{"url":"https://github.com/fastify/fastify/issues/6574","tags":["web"]},{"url":"https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90","tags":["web"]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4mh8-r7rc-xpvc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92081.json","tags":["advisory"]},{"url":"https://github.com/fastify/fastify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-92081","title":"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses","description":"fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.","status":"published","published":"2026-09-16T08:52:49.757Z","modified":"2026-09-16T14:00:59.305Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-80315","description":"fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.","status":"published","published":"2026-09-16T08:52:49Z","modified":"2026-09-16T14:00:59Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:28:16.201278Z"}],"ghsa":[{"id":"GHSA-4mh8-r7rc-xpvc","title":"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses","description":"### Impact\n\n`fastify` crashes with an uncaught `ERR_HTTP2_INVALID_CONNECTION_HEADERS` exception when a route that registers a response trailer via `reply.trailer()` is served over HTTP/2. Fastify unconditionally adds the `Transfer-Encoding: chunked` header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.\n\nOne unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (`http2: true`) and at least one route registers a trailer. HTTP/1.x responses are not affected.\n\n### Patches\n\nUpgrade to `fastify` `5.12.5` or later.\n\n### Workarounds\n\nAvoid registering response trailers with `reply.trailer()` on routes served over HTTP/2 until upgrading.","status":"published","published":"2026-09-30T23:53:44Z","modified":"2026-09-30T23:53:45Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-92081","description":"fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.","status":"published","published":"2026-09-16T09:17:10.137Z","modified":"2026-09-16T19:40:00.317Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"CVE-2026-92081","title":"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses","description":"fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.","status":"published","published":"2026-09-16T08:52:49.757Z","modified":"2026-10-28T02:30:38.476722774Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"GHSA-4mh8-r7rc-xpvc","title":"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses","description":"### Impact\n\n`fastify` crashes with an uncaught `ERR_HTTP2_INVALID_CONNECTION_HEADERS` exception when a route that registers a response trailer via `reply.trailer()` is served over HTTP/2. Fastify unconditionally adds the `Transfer-Encoding: chunked` header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.\n\nOne unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (`http2: true`) and at least one route registers a trailer. HTTP/1.x responses are not affected.\n\n### Patches\n\nUpgrade to `fastify` `5.12.5` or later.\n\n### Workarounds\n\nAvoid registering response trailers with `reply.trailer()` on routes served over HTTP/2 until upgrading.","status":"published","published":"2026-09-30T23:53:44Z","modified":"2026-10-01T00:00:05.778371686Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"CLSA-2026-1791626840","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.5.","status":"published","published":"2026-10-10T10:07:20Z","modified":"2026-10-15T09:48:04.600236831Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791667117","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.0-tuxcare.5.","status":"published","published":"2026-10-10T21:18:37Z","modified":"2026-10-15T09:47:39.681448548Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791680737","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.1-tuxcare.3.","status":"published","published":"2026-10-11T01:05:37Z","modified":"2026-10-15T09:45:40.48834439Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806519","title":"TuxCare security update for fastify (3 CVEs)","description":"TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.7.4-tuxcare.5.","status":"published","published":"2026-10-12T12:01:59Z","modified":"2026-10-15T09:47:40.246927962Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791839080","title":"TuxCare security update for fastify (3 CVEs)","description":"TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.11.3-tuxcare.6.","status":"published","published":"2026-10-12T21:04:40Z","modified":"2026-10-15T09:45:52.229940845Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792233310","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.6.","status":"published","published":"2026-10-17T10:35:10Z","modified":"2026-10-17T13:09:26.179993853Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792472724","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.4-tuxcare.1.","status":"published","published":"2026-10-20T05:05:24Z","modified":"2026-10-20T07:15:03.82037457Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793988537","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 3.29.5-tuxcare.8.","status":"published","published":"2026-11-06T19:08:58Z","modified":"2026-11-07T01:00:02.381809182Z","updated_at":"2026-11-07T01:26:17.791146Z"},{"id":"CLSA-2026-1794060794","title":"TuxCare security update for fastify (6 CVEs)","description":"TuxCare rebuilt fastify to address 6 CVEs. Fixed in 4.28.1-tuxcare.1.","status":"published","published":"2026-11-07T15:13:14Z","modified":"2026-11-07T19:00:36.656813145Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}