CVE-2026-120215

Name of the Vulnerable Software and Affected Versions @fastify/cors versions 8.2.0 through 11.3.x

Description An application using the CORS plugin for the Fastify web framework may crash during a CORS preflight request if the plugin is registered with a non-default onSend hook option. When an OPTIONS request containing the Origin and Access-Control-Request-Method headers is received, the plugin calls reply.send() from within the onSend hook, causing the response headers to be written twice. This results in an uncaught ERR HTTP HEADERS SENT error that can terminate the Node.js process if no process-level handler is present. An unauthenticated remote client can trigger this state with a single preflight request, impacting system availability.

Recommendations Update @fastify/cors to version 11.4.0 or later. As a temporary workaround, use a different hook such as the default onRequest or set the preflight option to false.