Executive brief
Fastify is a popular web framework for Node.js used to build web applications and APIs. When HTTP/2 is enabled and a route uses response trailers, a single unauthenticated HTTP/2 request crashes the entire server process, dropping all active connections. An attacker can repeatedly trigger this to keep the service offline.
Technical details
The vulnerability is an uncaught exception (CWE-248) in response header serialization. When a route registers a response trailer via reply.trailer() over HTTP/2, Fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden by the HTTP/2 specification. Node.js throws an ERR_HTTP2_INVALID_CONNECTION_HEADERS exception during header serialization that is not caught, causing an uncaughtException that terminates the process. The attack requires no authentication or user interaction and is network-accessible; only HTTP/2-enabled Fastify servers with routes using trailers are affected (HTTP/1.x is unaffected). The fix is available in versions 5.12.5 and 4.29.2 and later.
Affected products
- OpenJS Foundation Fastify before 5.12.5, before 4.29.2
Timeline
- 2026-09-16: disclosed: CVE-2026-92081 and GHSA-4mh8-r7rc-xpvc published
- 2026-09-16: patched: Fixed in versions 5.12.5 and 4.29.2