Fastify Cors
Monthly
CORS preflight handling in @fastify/cors 8.2.0 through 11.3.x can terminate the Node.js process when the plugin is registered with the non-default hook: 'onSend' option. On an OPTIONS request carrying Origin and Access-Control-Request-Method, the plugin calls reply.send from inside the onSend hook and re-enters Fastify's send pipeline, so a second write of the response headers throws ERR_HTTP_HEADERS_SENT; with no process-level handler installed, that uncaught exception kills the process. The trigger is a single unauthenticated request (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, 3.7), but only the non-default onSend configuration with preflight enabled is exposed - the default onRequest hook and deployments with preflight: false are unaffected - so this is a low-priority availability issue rather than an urgent threat, and no public exploit code was identified at time of analysis.
CORS preflight handling in @fastify/cors 8.2.0 through 11.3.x can terminate the Node.js process when the plugin is registered with the non-default hook: 'onSend' option. On an OPTIONS request carrying Origin and Access-Control-Request-Method, the plugin calls reply.send from inside the onSend hook and re-enters Fastify's send pipeline, so a second write of the response headers throws ERR_HTTP_HEADERS_SENT; with no process-level handler installed, that uncaught exception kills the process. The trigger is a single unauthenticated request (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, 3.7), but only the non-default onSend configuration with preflight enabled is exposed - the default onRequest hook and deployments with preflight: false are unaffected - so this is a low-priority availability issue rather than an urgent threat, and no public exploit code was identified at time of analysis.