CVE-2026-120216

Name of the Vulnerable Software and Affected Versions fastify versions 5.8.0 through 5.12.7

Description A denial of service issue exists when the server is configured with a nonzero handlerTimeout and a route returns a streaming response. If a request stream remains open beyond the timeout after headers have been sent, the server attempts to send a new error response. This triggers an uncaught ERR HTTP HEADERS SENT exception, which terminates the Node.js process and interrupts all other active requests. An unauthenticated remote client can trigger this by sending a single request to an affected streaming endpoint.

Recommendations Update fastify to version 5.12.8 or later. Set handlerTimeout to 0 to disable the affected timeout path as a temporary workaround.