fastify Denial-of-Service Flaw: Unhandled Exception Crashes HTTP/2 Servers (CVE-2026-92081)

What happened

A vulnerability was disclosed in fastify affecting routes that register a response trailer using reply.trailer() when served over HTTP/2. In versions before 5.12.5, fastify unconditionally sets the Transfer-Encoding: chunked header on such responses. This header is forbidden under the HTTP/2 protocol, causing Node.js to throw an exception while serializing the response headers. Because the exception is not caught, it becomes an uncaught exception that crashes the entire server process, terminating all in-flight requests in the process.

Technical cause

The root cause is an uncaught exception (CWE-248) triggered by a protocol violation: fastify sets the Transfer-Encoding: chunked header regardless of the underlying HTTP version, but HTTP/2 explicitly forbids this header. Node.js's HTTP/2 implementation throws when attempting to serialize response headers containing this forbidden field, and fastify does not catch this exception, allowing it to propagate and crash the process.

Why it matters

A single, unauthenticated HTTP/2 request to any route using response trailers is sufficient to crash a vulnerable fastify server. Since the process terminates, all in-flight requests at the time of the crash are dropped, and the attack can be repeated after every restart, enabling a persistent and low-effort denial-of-service condition.

Who is affected

Any application built on fastify versions prior to 5.12.5 that serves traffic over HTTP/2 and uses reply.trailer() to register response trailers on one or more routes is affected.

Affected versions

fastify versions from 0 up to, but not including, 5.12.5 are affected.

Fixes and mitigation

The issue is fixed in fastify version 5.12.5. Users should upgrade to 5.12.5 or later. As a temporary workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until the upgrade can be applied.

Recommended action

Upgrade affected fastify installations to version 5.12.5 or later as soon as possible. If immediate upgrading is not feasible, remove or avoid reply.trailer() calls on any route that is served over HTTP/2 as an interim mitigation.