CVE-2026-92081: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.12.5 - Compensating control
As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using Fastify before 5.12.5 are exposed only when an HTTP/2-served route registers a response trailer with reply.trailer(). Routes not using response trailers are not described as affected.
What does an attacker need to do to trigger the crash?
An unauthenticated attacker only needs to send one HTTP/2 request to an affected route. No privileges or user interaction are required, although the route must use reply.trailer().
What is the operational impact if exploitation succeeds?
The unhandled exception crashes the server process and drops all in-flight requests. An attacker can repeat the request after each restart to continue causing denial of service.
What can be done before upgrading?
Avoid registering response trailers with reply.trailer() on routes served over HTTP/2. The stated permanent fix is upgrading Fastify to version 5.12.5 or later.