CORS Plugin Crash Vulnerability in Fastify Web Framework

CVE-2026-120215

What is CVE-2026-120215?

The @fastify/cors plugin for the Fastify web framework has a vulnerability in versions 8.2.0 through 11.3.x that can lead to application instability. When the plugin is registered with a non-default onSend hook option, an OPTIONS request containing Origin and Access-Control-Request-Method headers can cause the application to crash. This occurs due to a re-entry into the send pipeline when reply.send is called, resulting in the ERR_HTTP_HEADERS_SENT error. This issue can be triggered by an unauthenticated remote client and poses a risk to application availability. Users are advised to upgrade to @fastify/cors version 11.4.0 or later to mitigate this risk, where the problematic onSend hook configuration is no longer accepted. As a temporary workaround, switching to the default onRequest hook or disabling preflight handling is recommended.

References