HTTP/2 Vulnerability in fastify Framework for Node.js

CVE-2026-92081

What is CVE-2026-92081?

The fastify framework for Node.js, prior to version 5.12.5, contains a vulnerability that affects HTTP/2 requests. When a route utilizes response trailers via reply.trailer(), the framework improperly sets the Transfer-Encoding header to chunked. This action is a violation of HTTP/2 specifications, causing Node.js to throw an uncaught exception during the serialization of response headers. Consequently, this can lead to a server crash, resulting in the disruption of all ongoing requests. Users of fastify are advised to upgrade to version 5.12.5 or later to mitigate this issue. As an interim measure, refrain from registering response trailers on HTTP/2 routes until an upgrade can be performed.

References