Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120216— fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

Quick assessment

Affected
fastify fastify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fastify 是一个用于 Node.js 的 Web 框架。在 5.8.0 至 5.12.7 版本中，当服务器配置了非零的 且某个路由返回流式响应时，若请求的流已发送响应头但仍保持打开状态并超过设定的超时时间，将导致服务器崩溃。当超时时，Fastify 会尝试在已启动的响应上发送新的错误响应，从而触发未捕获的 错误，最终终止 Node.js 进程并中断所有正在处理中的请求。未认证的远程攻击者只需向受影响的流式端点发送单个请求即可触发此漏洞。该漏洞的影响范围仅限于可用性（拒绝服务），且利用该漏洞需要配置非默认的 值

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120216

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
Source: CVE Program / CVE List V5
Vulnerability Description
fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fastify fastify 5.8.0 ~ 5.12.8 -

II. Public POCs for CVE-2026-120216

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120216

请登录查看更多情报信息。

Other References for CVE-2026-120216 (1)

IV. Related Vulnerabilities

Same product: fastify
Same vendor: fastify
Same weakness: CWE-248