Read the docs
TI-2026-83786 Aliases CVE-2026-120216

Fastify crashes on handler timeout with streaming responses

Priority LOW 26CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-248.

Summary

Fastify versions from 5.8.0 before 5.12.8 are affected. With a nonzero handlerTimeout, a streaming response whose headers were already sent and whose stream stays open past the timeout makes Fastify raise an uncaught exception (CWE-248) that terminates the Node.js process. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, which interrupts other in-flight requests. The default handlerTimeout of 0 is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Partial fastify (fastify): 5.12.8Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastifyfastify5.8.0 to before 5.12.85.12.8Patch availableCNA
  • fastify Vendorfastify Affected 5.8.0 to before 5.12.8 Fixed in 5.12.8 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify:*:*:*:*:*:*:*:*——fastify
  • cpe:2.3:a:fastify:fastify:*:*:*:*:*:*:*:* Versions — — ·fastify

Remediation

Upgrade fastify to 5.12.8 or later, which fixes this. As a workaround, set handlerTimeout to 0, which disables the affected timeout path. Red Hat lists Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) and Red Hat OpenShift Dev Spaces as affected without a fix, with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA fastify (fastify) Fixed in 5.12.8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120216
  2. 2026-11-02 Affected versions changed · Red Hat
  3. 2026-11-02 CVSS score added · Red Hat
  4. 2026-11-02 CISA SSVC decision points changed
  5. 2026-11-02 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization… CVSS 4.0CRITICAL 9.1
  • TI-2026-26179 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
  • TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
  • TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
  • TI-2023-15307 Cross-site request forgery in npm @fastify/oauth2 CVSS 3.1HIGH 8.8
  • TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences