CVE-2026-92081: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
Impact
fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.
One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.
Patches
Upgrade to fastify 5.12.5 or later.
Workarounds
Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
Other sources
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fastifyto a version that resolves this vulnerability.Fixed in 5.12.5 - Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.12.5 - Compensating control
Until upgrading, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 (http2: true).
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using Fastify before 5.12.5 are exposed only when an HTTP/2-served route registers a response trailer with reply.trailer(). Routes not using response trailers are not described as affected.
What does an attacker need to do to trigger the crash?
An unauthenticated attacker only needs to send one HTTP/2 request to an affected route. No privileges or user interaction are required, although the route must use reply.trailer().
What is the operational impact if exploitation succeeds?
The unhandled exception crashes the server process and drops all in-flight requests. An attacker can repeat the request after each restart to continue causing denial of service.
What can be done before upgrading?
Avoid registering response trailers with reply.trailer() on routes served over HTTP/2. The stated permanent fix is upgrading Fastify to version 5.12.5 or later.