fastify is a fast and low-overhead web framework for Node.js.

CVE-2026-92081 affects the Fastify web framework for Node.js in all versions prior to 5.12.5. When a route registers a response trailer via reply.trailer() and the request arrives over HTTP/2, Fastify unconditionally injects a Transfer-Encoding: chunked header — a header that HTTP/2 explicitly forbids. Node.js throws while serializing the response, producing an uncaught exception (CWE-248) that kills the entire process. Every in-flight request is dropped. The crash is repeatable on every restart, meaning a single attacker can loop and keep the service down indefinitely.

The vendor's MEDIUM / 5.9 rating is directionally correct but slightly generous. The CVSS vector scores AC:H (high attack complexity), which acknowledges the narrow trigger conditions, but the score still overweights the unauthenticated-remote posture without discounting for two compounding prerequisites: the service must expose HTTP/2 *directly* to the Fastify process (most production deployments terminate HTTP/2 at a reverse proxy like Nginx, ALB, or Cloudflare), and at least one route must use the reply.trailer() API, which is uncommon in real codebases. When both conditions align the bug is trivially weaponizable — one crafted request crashes the server — but the population of deployments meeting both conditions is small. A reassessed score of 5.0 better reflects real-world exposure.

Why this verdict

• Dual prerequisite gate: The bug only fires when HTTP/2 reaches Fastify directly *and* a route uses reply.trailer(). Each condition independently eliminates a large fraction of the install base; combined, the reachable population is very small.
• Availability-only impact: The worst outcome is a process crash (DoS). There is no memory corruption, no code execution, no data leak. The CVSS vector confirms C:N/I:N/A:H.
• Auto-restart dampening: Modern deployments run Fastify under PM2, systemd, or Kubernetes, all of which auto-restart crashed processes. Sustained DoS requires the attacker to maintain a loop, which is detectable and blockable.
• Role multiplier: Fastify is an application-tier web framework. It is *not* an identity provider, hypervisor, domain controller, kernel agent, or network edge appliance. (a) *Low-value role (dev/sandbox):* chain succeeds if both conditions met — blast radius is one dev process, negligible. (b) *Typical role (API microservice behind a load balancer):* HTTP/2 is almost always terminated at the LB/proxy, so the chain usually fails; if it succeeds, blast radius is one replica pod, mitigated by auto-restart. (c) *High-value role (API gateway):* conceivable but uncommon; even here, the impact is DoS of one process, not domain/fleet/supply-chain compromise. No high-value role scenario reaches the blast radius floor for a HIGH verdict.
• No exploitation pressure: EPSS is 0.4%, no KEV listing, no public PoC, no observed campaigns. The bug has been public for one day with zero weaponization signals.

Why not higher?

Upgrading to HIGH would require either a path to code execution, a broader reachable population, or active exploitation — none of which exist. The dual prerequisite (HTTP/2 + trailer API) compresses the exposed population well below 10% of the Fastify install base, and the impact ceiling is a recoverable process crash with no confidentiality or integrity consequences.

Why not lower?

Dropping to LOW would undercount the risk for the narrow set of deployments that *do* expose HTTP/2 directly and use trailers. In those environments, the crash is trivially repeatable, unauthenticated, and can sustain a service outage. The 8.5M weekly download footprint means even a small percentage translates to a non-trivial absolute number of vulnerable services.

1. Remove reply.trailer() calls from HTTP/2 routes — The vendor-documented workaround. Audit your codebase for reply.trailer() usage and remove or conditionally disable it when the connection is HTTP/2. This eliminates the trigger entirely. Apply immediately if you cannot upgrade within the 365-day noisgate remediation SLA.
2. Terminate HTTP/2 at the reverse proxy — Configure Nginx, HAProxy, AWS ALB, or Cloudflare to terminate HTTP/2 and forward HTTP/1.1 to Fastify. This prevents the illegal header from being generated. Most production deployments already do this — verify yours does.
3. Enable crash-loop alerting — Ensure your process manager (PM2, systemd, Kubernetes) alerts on repeated restarts. Set a CrashLoopBackOff threshold to page on-call if the process crashes more than 3 times in 5 minutes, so you can respond to active exploitation quickly.
4. Rate-limit HTTP/2 connections at the edge — Apply per-IP connection rate limits at your load balancer or WAF to slow an attacker's ability to repeatedly crash the process on every restart.

Run this on any host with node and npm installed to check whether the installed fastify version is vulnerable. No special privileges needed. Example: bash check_cve_2026_92081.sh /path/to/your/project

#!/usr/bin/env bash
# CVE-2026-92081 - Fastify HTTP/2 trailer crash check
# Usage: bash check_cve_2026_92081.sh [project_dir]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"

if [ ! -d "$PROJECT_DIR/node_modules/fastify" ]; then
  echo "UNKNOWN - fastify not found in $PROJECT_DIR/node_modules"
  exit 2
fi

VERSION=$(node -e "try { console.log(require('$PROJECT_DIR/node_modules/fastify/package.json').version) } catch(e) { console.log('error') }")

if [ "$VERSION" = "error" ]; then
  echo "UNKNOWN - could not read fastify version"
  exit 2
fi

echo "Detected fastify version: $VERSION"

# Compare versions - 5.12.5 is the fix
FIXED="5.12.5"

version_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

if version_gte "$VERSION" "$FIXED"; then
  echo "PATCHED - fastify $VERSION >= $FIXED"
  exit 0
else
  echo "VULNERABLE - fastify $VERSION < $FIXED (CVE-2026-92081)"
  echo "Upgrade: npm install fastify@^5.12.5"
  exit 1
fi

Sources

1. OpenCVE - CVE-2026-92081 Details
2. Strix AI - CVE-2026-92081 Advisory
3. GitHub Advisory GHSA-4mh8-r7rc-xpvc
4. Fastify Issue #7030 - reply.trailer() breaks on bodyless responses
5. Fastify Reply Documentation (latest)
6. npm trends - Fastify download statistics
7. CVE Details - Fastify Security Vulnerabilities