---
id: CVE-2026-92081
title: fastify is a fast and low-overhead web framework for Node.js
summary: >-
  fastify is a fast and low-overhead web framework for Node.js. In versions
  before 5.12.5, when a route registers a response trailer via reply.trailer()
  and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding:
  chunked…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
vendor: fastify
product: fastify
affected:
  - fastify < 5.12.5
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:40:00.317'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92081'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: 'https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92081.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92081'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535071'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92081'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92081'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T14:00:06.966478Z'
ingestedAt: '2026-09-16T09:53:11.601Z'
epss: 0.00395
epssPercentile: 0.3351
---

## Overview

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92081.json)