GHSA-4mh8-r7rc-xpvc

Source

https://github.com/advisories/GHSA-4mh8-r7rc-xpvc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-4mh8-r7rc-xpvc/GHSA-4mh8-r7rc-xpvc.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4mh8-r7rc-xpvc

Aliases

CVE-2026-92081

Published

2026-09-30T23:53:44Z

Modified

2026-10-01T00:00:04Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Details

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Database specific

{
    "cwe_ids": [
        "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-30T23:53:44Z",
    "nvd_published_at": "2026-09-16T09:17:10Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / fastify

Package

Name: fastify; View open source insights on deps.dev
Purl: pkg:npm/fastify

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.12.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-4mh8-r7rc-xpvc/GHSA-4mh8-r7rc-xpvc.json"