CVE-2026-120216 fastify CVE debrief

Who should care

Defenders responsible for Node.js applications using Fastify should assess exposure and prioritize verification of handlerTimeout configurations. They should also consider upgrading to Fastify 5.12.8 or later or setting handlerTimeout to 0 as a workaround. This vulnerability can cause server crashes, potentially leading to denial-of-service (DoS) and impacting application availability.

Why it matters

CVE-2026-120216 is a vulnerability in Fastify that can cause server crashes when a request stream stays open past the handlerTimeout. Defenders should assess exposure, prioritize verification of handlerTimeout configurations, and consider upgrading to Fastify 5.12.8 or later.

• Potential denial-of-service (DoS) due to server crashes
• Need to verify handlerTimeout configurations for Fastify versions 5.8.0 through 5.12.7
• Possible impact on application availability

Technical summary

In versions 5.8.0 through 5.12.7 of Fastify, a web framework for Node.js, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. This occurs because Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set.

Defensive priority

Defenders should assess exposure and prioritize verification of handlerTimeout configurations for Fastify versions 5.8.0 through 5.12.7.

Recommended defensive actions

• Verify handlerTimeout configurations for Fastify versions 5.8.0 through 5.12.7
• Upgrade to Fastify 5.12.8 or later
• Set handlerTimeout to 0 as a workaround
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue is fixed in fastify 5.12.8. As a workaround, set handlerTimeout to 0, which disables the affected timeout path. Evidence is based on the official CVE Program record and NIST NVD detail page. Defenders should verify handlerTimeout configurations for Fastify versions 5.8.0 through 5.12.7 and consider upgrading to Fastify 5.12.8 or later. The CVE record was published on 2026-11-02T11:17:31.553Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.