CVE-2026-92081: Fastify Denial of Service via Unhandled Exception on HTTP/2 Trailer Responses
Summary
CVE-2026-92081: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses. Affects fastify versions < 5.12.5. Fixed in 5.12.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed to be highly performant and low overhead. It allows developers to build web applications and APIs with ease, providing features such as routing, middleware support, and plugin architecture. However, when using Fastify with HTTP/2, a specific vulnerability arises related to response trailers, which can lead to server crashes.
Vulnerability Detail
The vulnerability in Fastify occurs when an uncaught 'ERR_HTTP2_INVALID_CONNECTION_HEADERS' exception is thrown while serving a route that registers a response trailer via 'reply.trailer()' over HTTP/2. Fastify adds the 'Transfer-Encoding: chunked' header unconditionally when a trailer is set, which is not permitted in HTTP/2. This results in Node.js throwing an error during the serialization of response headers, leading to an uncaught exception that terminates the Node.js process. An unauthenticated HTTP/2 request to any route using trailers can crash the server, affecting all in-flight requests and allowing repeated requests to keep the process down. This issue only affects applications with HTTP/2 enabled and at least one route that registers a trailer, while HTTP/1.x responses remain unaffected.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.12.5
This is the first release that contains the fix.
npm install fastify@5.12.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid registering response trailers with 'reply.trailer()' on any routes served over HTTP/2 until you can upgrade to the patched version. This will prevent the server from crashing due to the unhandled exception.
Conclusion
In summary, the vulnerability identified as CVE-2026-92081 affects Fastify when used with HTTP/2 and response trailers, leading to potential Denial of Service. It is crucial to upgrade to version 5.12.5 or later to mitigate this risk. Until then, avoid using response trailers in HTTP/2 routes as a workaround.
See every vulnerability recorded for fastify →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If left unaddressed, this vulnerability can lead to Denial of Service (DoS) attacks, where an attacker can crash your server by sending specific HTTP/2 requests.
No, this vulnerability is present in Fastify versions prior to 5.12.5. Upgrading to 5.12.5 or later will resolve the issue.
Yes, you can use HTTP/2 safely with Fastify as long as you avoid using response trailers until you upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
