Node.js Fastify Framework Vulnerability in Streaming Responses

CVE-2026-120216

What is CVE-2026-120216?

The Fastify web framework for Node.js has a vulnerability that affects versions 5.8.0 through 5.12.7. When configured with a nonzero handlerTimeout, the server may crash if a route returns a streaming response. If a request's stream sends its headers and remains open after the timeout, Fastify attempts to send an error response on an already-started response. This action raises an uncaught ERR_HTTP_HEADERS_SENT error, terminating the Node.js process and aborting other in-flight requests. An unauthenticated remote client can exploit this scenario with a single request to a streaming endpoint. Users are encouraged to upgrade to Fastify version 5.12.8 or later to mitigate this issue. A temporary workaround includes setting the handlerTimeout to 0, thereby disabling the affected timeout path.

References