{"vulnerability": "GHSA-4mh8-r7rc-xpvc", "sightings": [{"uuid": "0965ec21-2e4d-4248-aa3d-b93a4dbbfa38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4mh8-r7rc-xpvc", "type": "seen", "source": "https://gist.github.com/alon710/787a441b981f5f49f05bb8066f738178", "content": "# CVE-2026-92081: CVE-2026-92081: Denial of Service via Uncaught Exception on HTTP/2 Response Trailers in Fastify\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92081\n\n## Summary\nA protocol validation vulnerability exists in Fastify before version 5.12.5. When serving requests over HTTP/2, Fastify unconditionally injects the forbidden Transfer-Encoding header when response trailers are used, triggering an uncaught exception in Node.js and crashing the process.\n\n## TL;DR\nUnauthenticated remote HTTP/2 requests to Fastify endpoints utilizing response trailers trigger an uncaught validation exception in Node.js, immediately crashing the server.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248\n- **Attack Vector**: Network\n- **CVSS Score**: 5.9\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS)\n\n## Affected Systems\n\n- Fastify\n- **Fastify**: < 5.12.5 (Fixed in: `5.12.5`)\n\n## Mitigation\n\n- Upgrade Fastify to version 5.12.5 or later.\n- Disable HTTP/2 support in Fastify configuration if not strictly necessary.\n- Implement conditional trailer registration by verifying the active protocol version before calling reply.trailer().\n\n**Remediation Steps:**\n1. Navigate to the application root directory.\n2. Update the Fastify dependency in package.json to \"^5.12.5\" or run \"npm install fastify@5.12.5\".\n3. Verify that the package-lock.json or yarn.lock file reflects the correct version upgrade.\n4. Deploy the updated application to staging environment and execute verification tests over HTTP/2 connections.\n5. Monitor application logs for uncaughtException events during traffic serialization.\n\n## References\n\n- [GHSA-4mh8-r7rc-xpvc](https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc)\n- [Fastify Patch Commit ad06a4c](https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90)\n- [Fastify Release v5.12.5](https://github.com/fastify/fastify/releases/tag/v5.12.5)\n- [NVD CVE-2026-92081](https://nvd.nist.gov/vuln/detail/CVE-2026-92081)\n- [CVE.org CVE-2026-92081](https://www.cve.org/CVERecord?id=CVE-2026-92081)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92081) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T02:30:29.000000Z"}]}