CVE-2026-120215 @fastify/cors CVE debrief

Who should care

Defenders of applications using the @fastify/cors plugin with the non-default onSend hook option should assess exposure and upgrade to 11.4.0 or later. This includes operators, security teams, and vulnerability management teams. They should verify and upgrade to @fastify/cors 11.4.0 or later to prevent crashes on CORS preflight requests. Exposure review and compensating controls implementation are also recommended.

Why it matters

CVE-2026-120215 is a vulnerability in the @fastify/cors plugin for the Fastify web framework that can cause crashes on CORS preflight requests. Defenders should assess exposure and upgrade to 11.4.0 or later.

• Verify and upgrade to @fastify/cors 11.4.0 or later to prevent crashes
• Assess exposure of applications using the non-default onSend hook option
• Implement workarounds such as using another hook or setting preflight to false

Technical summary

The @fastify/cors plugin for the Fastify web framework crashes on a CORS preflight request when the non-default onSend hook option is used. This issue is fixed in @fastify/cors 11.4.0. The vulnerability is triggered by a single preflight request with the Origin and Access-Control-Request-Method headers. The impact is availability only, and exploitation requires the non-default onSend configuration. Defenders should assess exposure and upgrade to 11.4.0 or later. The plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed

Defensive priority

Upgrade to @fastify/cors 11.4.0 or later to prevent crashes on CORS preflight requests.

Recommended defensive actions

• Upgrade to @fastify/cors 11.4.0 or later
• Use any other hook such as the default onRequest
• Set preflight to false as a workaround
• Verify and upgrade to @fastify/cors 11.4.0 or later to prevent crashes
• Assess exposure of applications using the non-default onSend hook option
• Implement workarounds such as using another hook or setting preflight to false
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability is triggered by a single preflight request with the Origin and Access-Control-Request-Method headers. The impact is availability only, and exploitation requires the non-default onSend configuration.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.