CVE-2026-120215
Received Received - Intake

Denial of Service in Fastify CORS Plugin

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: openjs

Description
@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120215

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
@fastify/cors @fastify/cors 8.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @fastify/cors package in versions 8.2.0 through 11.3.x. When configured with the non-default 'onSend' hook, the plugin crashes on CORS preflight requests. It calls reply.send() inside the onSend hook, re-entering the send pipeline and causing a second write of response headers. This triggers an uncaught ERR_HTTP_HEADERS_SENT error that can terminate the Node.js process if no handler is installed.

Detection Guidance

Check if your system uses @fastify/cors versions between 8.2.0 and 11.3.x by running: npm list @fastify/cors. If the output shows a version in this range, the system is vulnerable. Also inspect Fastify application code for non-default 'onSend' hook usage in @fastify/cors configuration.

Impact Analysis

The impact is limited to availability. An unauthenticated remote attacker can send a single OPTIONS request with Origin and Access-Control-Request-Method headers to crash the server. The server process may terminate if no process-level error handler is installed. No data is exposed or modified.

Compliance Impact

This vulnerability primarily affects service availability and does not directly impact data confidentiality or integrity. Compliance with GDPR or HIPAA would depend on whether the outage caused by this vulnerability leads to a breach of service-level agreements or regulatory requirements for uptime and availability.

Mitigation Strategies

Upgrade @fastify/cors to version 11.4.0 or later using: npm update @fastify/cors. Alternatively, modify the application to use a different hook like 'onRequest' or set preflight to false in the configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120215. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...