Is CVE-2026-120216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120216 being exploited in the wild.

How severe is CVE-2026-120216?

Medium severity, with a CVSS score of 5.9, published 2 November 2026.

Which products and versions are affected?

OpenJS Foundation Fastify 5.8.0 through 5.12.7.

How is CVE-2026-120216 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120216?

Check whether you run OpenJS Foundation Fastify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120216: Fastify denial of service via uncaught exception on handlerTimeout with streaming responses

CVE-2026-120216 · Severity: medium · CVSS 5.9 · Published 2026-11-02

Fastify is a web application framework for Node.js used to build web services. When configured with a nonzero handlerTimeout setting and a route streams data, an attacker can send a single request that keeps the connection open past the timeout, causing the server to crash and interrupt all other active requests. This results in complete unavailability of the service.

Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-120216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120216 being exploited in the wild.
How severe is CVE-2026-120216?: Medium severity, with a CVSS score of 5.9, published 2 November 2026.
Which products and versions are affected?: OpenJS Foundation Fastify 5.8.0 through 5.12.7.
Is there a fix for CVE-2026-120216?: Yes: fixed in 5.12.8. Until then: Set handlerTimeout to 0, which disables the affected timeout path and restores the default non-vulnerable behavior. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120216 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120216?: Check whether you run OpenJS Foundation Fastify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.12.8

Set handlerTimeout to 0, which disables the affected timeout path and restores the default non-vulnerable behavior.

Technical details

The vulnerability is an uncaught exception (CWE-248) triggered when Fastify attempts to send an error response on a streaming response that has already transmitted headers. When handlerTimeout fires on a streaming endpoint, Fastify tries to send headers a second time, raising ERR_HTTP_HEADERS_SENT and terminating the Node.js process. An unauthenticated remote attacker can exploit this over the network with no user interaction required, provided handlerTimeout is set to a nonzero value (the default value of 0 is not vulnerable).

Affected products

OpenJS Foundation Fastify 5.8.0 through 5.12.7

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.