Fastify CVE-2026-92081

Requires the target Fastify application (before 5.12.5) to (1) serve traffic over HTTP/2 and (2) have at least one route that registers a response trailer via reply.trailer(). Both are non-default and application-specific: Fastify defaults to HTTP/1.x unless HTTP/2 is explicitly enabled, and trailers are an uncommon feature developers must opt into. When those conditions hold, no authentication or user interaction is needed - a single crafted HTTP/2 request to the affected route crashes the whole process. The limiting factor is therefore the presence of a trailer-using HTTP/2 route, not access; applications not using trailers on HTTP/2 are unaffected. The workaround is to avoid reply.trailer() on HTTP/2 routes until upgrading to 5.12.5.

This is a genuine but bounded availability risk, and notably the signals are self-consistent rather than inflated - a refreshing contrast to many CVSS-9.8 Node.js advisories. The CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: it correctly scopes impact to availability only (A:H, C:N/I:N - no data disclosure or integrity effect from an uncaught-exception crash) and uses AC:H to reflect that exploitation is not universal but conditioned on the target application registering response trailers via reply.trailer() on an HTTP/2-served route. PR:N is accurate - a single unauthenticated HTTP/2 request suffices once such a route exists. There is no KEV listing, no public POC referenced, and no EPSS score supplied, so exploitation is theoretical at time of analysis. The SSVC framing would be exploitation:none, automatable:yes (a trivial repeatable request against a vulnerable route), technical impact:partial (availability-only, though the crash is total for the process). The practical severity hinges entirely on whether real deployments actually use trailers on HTTP/2 routes - trailers are an uncommon feature, which is precisely why AC:H is justified and why widespread mass-exploitation is unlikely despite Fastify's popularity. No key signals conflict.

An attacker identifies a Fastify (<5.12.5) service exposed over HTTP/2 that has at least one route calling reply.trailer(), then sends a single unauthenticated HTTP/2 request to that route. Fastify sets the HTTP/2-forbidden Transfer-Encoding: chunked header, Node.js throws during header serialization, the exception goes uncaught and becomes an uncaughtException that crashes the entire process, dropping all in-flight requests. No public exploit code is identified, but the trigger is trivial and repeatable on every process restart.