@fastify/cors CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW @fastify/cors CVE published 2026-11-02

CVE-2026-120215

CVE-2026-120215 is a vulnerability in the @fastify/cors plugin for the Fastify web framework. An application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight request. This issue is fixed in @fastify/cors 11.4.0. Users should upgrade to 11.4.0 or later. The vulnerability is triggered by a single preflight request with the Origin and Access-Control-Request-Method [truncated]