CVE-2026-92081: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.
One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.
References
- cna.openjsf.org/security-advisories.html
- github.com/advisories/GHSA-4mh8-r7rc-xpvc
- github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90
- github.com/fastify/fastify/issues/6574
- github.com/fastify/fastify/releases/tag/v5.12.5
- github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc
- nvd.nist.gov/vuln/detail/CVE-2026-92081
Code Behaviors & Features
Detect and mitigate CVE-2026-92081 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →