CVE-2026-92081 Overview
CVE-2026-92081 is a denial-of-service vulnerability in Fastify, a low-overhead web framework for Node.js. Versions prior to 5.12.5 unconditionally set the Transfer-Encoding: chunked header when a route registers a response trailer via reply.trailer() and is served over HTTP/2. HTTP/2 forbids this header, causing Node.js to throw while serializing response headers. The uncaught exception surfaces as an uncaughtException event and terminates the server process. A single unauthenticated HTTP/2 request to any route using trailers crashes the server and drops all in-flight requests. The issue is tracked under [CWE-248] (Uncaught Exception).
Critical Impact
One unauthenticated HTTP/2 request to a trailer-enabled route crashes the Fastify process, terminating all active connections. The attack is fully repeatable after every restart.
Affected Products
- Fastify versions prior to 5.12.5
- Node.js applications built on Fastify serving traffic over HTTP/2
- Any Fastify route registering response trailers via reply.trailer()
Discovery Timeline
- 2026-09-16 - CVE-2026-92081 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92081
Vulnerability Analysis
The vulnerability originates in Fastify's response serialization path. When application code invokes reply.trailer() to register an HTTP trailer, Fastify appends a Transfer-Encoding: chunked header to the outgoing response. Chunked transfer encoding is an HTTP/1.1 construct. HTTP/2 replaces it with its own framing layer and explicitly forbids the Transfer-Encoding header when the value is chunked.
Node.js validates outgoing HTTP/2 headers before serialization. When it encounters the forbidden header, it throws an error. Fastify does not wrap this write path in a handler for the HTTP/2 response stream. The error propagates to the Node.js event loop as an uncaughtException, terminating the process by default.
Because the crash occurs during response header serialization, every in-flight request on the process is dropped alongside the offending request. Restarting the process does not remediate the issue; the same request pattern reproduces the crash indefinitely.
Root Cause
The defect is a missing protocol-aware branch in Fastify's trailer handling logic. The framework applies HTTP/1.1 semantics to responses without inspecting the underlying transport protocol. Combined with the absence of exception containment around the HTTP/2 write, this makes a recoverable protocol error a fatal process condition.
Attack Vector
An unauthenticated remote attacker sends an HTTP/2 request to any route that registers a response trailer. No credentials, session state, or user interaction are required. The attacker only needs network reachability to the Fastify service and knowledge of a route that invokes reply.trailer(). Repeated requests amplify the impact by crashing each restarted worker in turn.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-4mh8-r7rc-xpvc for maintainer analysis.
Detection Methods for CVE-2026-92081
Indicators of Compromise
- Repeated Node.js process restarts correlated with inbound HTTP/2 requests to trailer-enabled routes.
- uncaughtException log entries referencing HTTP/2 header serialization or invalid Transfer-Encoding values.
- Application logs showing dropped in-flight requests immediately preceding a process exit.
Detection Strategies
- Inventory Fastify applications and identify routes that call reply.trailer() served over HTTP/2.
- Alert on Node.js worker restart frequency exceeding baseline, especially on public-facing services.
- Correlate reverse proxy or load balancer HTTP/2 request logs with backend process termination events.
Monitoring Recommendations
- Enable structured logging for uncaughtException and forward events to a centralized SIEM.
- Monitor process supervisors such as pm2, systemd, or Kubernetes for repeated crash-loop conditions.
- Track 502 or 503 response spikes from upstream proxies fronting Fastify services.
How to Mitigate CVE-2026-92081
Immediate Actions Required
- Upgrade Fastify to 5.12.5 or later across all Node.js services.
- Audit application code for calls to reply.trailer() and confirm the transport protocol for each affected route.
- Ensure process supervisors are configured to restart crashed workers while the patch is deployed.
Patch Information
The issue is fixed in Fastify 5.12.5. The patch conditionally omits the Transfer-Encoding: chunked header when the response is served over HTTP/2. Refer to the GitHub Security Advisory GHSA-4mh8-r7rc-xpvc and the OpenJS Foundation Security Advisories for release details.
Workarounds
- Remove or comment out reply.trailer() calls on routes that may be served over HTTP/2 until the upgrade is complete.
- Disable HTTP/2 at the Fastify layer or terminate HTTP/2 at an upstream proxy that downgrades to HTTP/1.1 for the backend.
- Restrict network access to trailer-enabled routes using authentication middleware or network policy where feasible.
# Upgrade Fastify to the patched release
npm install fastify@^5.12.5
npm audit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
