Ravin06

Authenticated users can cause uncontrolled resource consumption by bypassing the `service.maxitemsperpage` limit. By sending `page=0` to `/api/v1` list endpoints, an attacker can trigger unbounded SQL queries, memory materialisation, and per-row query fan-out, which degrades service availability for other users.

An application using the CORS plugin for the Fastify web framework may crash during a CORS preflight request if the plugin is registered with a non-default `onSend` hook option. When an OPTIONS request containing the Origin and Access-Control-Request-Method headers is received, the plugin calls `reply.send()` from within the `onSend` hook, causing the response headers to be written twice. This results in an uncaught ERR HTTP HEADERS SENT error that can terminate the Node.js process if no process-level handler is present. An unauthenticated remote client can trigger this state with a single preflight request, impacting system availability.