CVE-2026-92081— fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
Quick assessment
Affected
fastify fastify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Fastify 是一个专为 Node.js 打造的高性能、低开销 Web 框架。在 5.12.5 之前的版本中，当某个路由通过 注册了响应尾标（response trailer），且该路由通过 HTTP/2 协议提供服务时，Fastify 会无条件地设置 响应头。然而，在 HTTP/2 中， 是被禁止使用的。因此，Node.js 在序列化响应头时会抛出异常。 该异常未被捕获，最终变为 （未捕获异常），导致服务器进程崩溃。这意味着，只要有一个未认证的 HTTP/2 请求发往任何使用了尾标的路由，就会触发该崩溃，进而使
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92081
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
Source: CVE Program / CVE List V5
Vulnerability Description
fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92081
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92081
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92081 (1)
IV. Related Vulnerabilities
Same product: fastify
-
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplet -
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped -
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed UR -
CVE-2026-84504
fastify vulnerable to request body replacement via an async -
CVE-2026-16732
fastify vulnerable to X-Forwarded-* spoofing under trustProx
Same vendor: fastify
-
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplet -
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped -
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed UR -
CVE-2026-84504
fastify vulnerable to request body replacement via an async -
CVE-2026-16732
fastify vulnerable to X-Forwarded-* spoofing under trustProx
Same weakness: CWE-248
-
CVE-2026-82410
Pocketbase: Unhandled panic in worker goroutines -
CVE-2026-61544
libp2p-quic: Remote panic via certificate expiry race during -
CVE-2026-55244
ASTEVAL: Sandbox Escape via BaseException Subclasses -
CVE-2026-53496
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeEr -
CVE-2026-54541
Nimiq: Panic in TrieProof::verify via child_index unwrap on
V. Comments for CVE-2026-92081
No comments yet