CVE-2026-120216
Received Received - Intake

Fastify Server Crash via Streaming Response Timeout

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: openjs

Description
fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120216

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fastify fastify 5.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Fastify web framework for Node.js versions 5.8.0 through 5.12.7. When a server is configured with a nonzero handlerTimeout and a route returns a streaming response, a client can send a request that sends headers but keeps the connection open past the timeout. This causes the server to crash with an uncaught error when trying to send an error response, terminating the Node.js process and disrupting other requests.

Detection Guidance

To detect this vulnerability, check if your Fastify server is running a version between 5.8.0 and 5.12.7 and has a nonzero handlerTimeout configured. Inspect the server logs for crashes with ERR_HTTP_HEADERS_SENT errors during streaming responses.

Impact Analysis

The impact is limited to availability. An unauthenticated remote attacker can crash the server with a single request to a vulnerable streaming endpoint, causing downtime and interrupting other in-flight requests. The default handlerTimeout of 0 is not affected.

Compliance Impact

This vulnerability primarily impacts availability by crashing the server, which could lead to service disruptions. For GDPR, this may affect the right to uninterrupted service. For HIPAA, it could disrupt access to protected health information systems. However, the vulnerability does not directly compromise confidentiality or integrity of data.

Mitigation Strategies

Upgrade Fastify to version 5.12.8 or later. Alternatively, set handlerTimeout to 0 to disable the affected timeout path as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120216. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...