fastify fastify-cors up to 11.3.x OnSend Hook reply.send onSend denial of service

Summaryinfo

A vulnerability was found in fastify fastify-cors up to 11.3.x. It has been rated as problematic. Affected by this issue is the function reply.send of the component OnSend Hook. This manipulation of the argument onSend causes denial of service. This vulnerability appears as CVE-2026-120215. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in fastify fastify-cors up to 11.3.x. It has been declared as problematic. Affected by this vulnerability is the function reply.send of the component OnSend Hook. The manipulation of the argument onSend with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-120215 since 10/31/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 11.4.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-115123). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• fastify

Name

• fastify-cors

Version

• 11.0
• 11.1
• 11.2
• 11.3

Website

• Product: https://github.com/fastify/fastify-cors/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion