CVE-2026-120216: fallo de gravedad media en fastify
fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.3%
fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
fastify · fastifyCVEs relacionadas — fastify
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-39288HIGHDenial of service in Fastify via Content-Type headerEPSS 59.2%CVE-2026-25223HIGHFastify's Content-Type header tab character allows body validation bypassEPSS 0.9%CVE-2025-32442HIGHFastify vulnerable to invalid content-type parsing, which could lead to validation bypassEPSS 0.7%CVE-2026-25224LOWFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamEPSS 0.5%CVE-2026-76169HIGHfastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersEPSS 0.5%CVE-2026-84428HIGHfastify vulnerable to header validation bypass via incomplete schema case normalizationEPSS 0.5%