{"cve":"CVE-2026-120215","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.2.0,11.4.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"11.4.0"}}],"enrichment":{"confidence":100.0,"confidence_source":"manual","scores":[{"score":100.0,"source":"manual"}]},"original":{"product":"@fastify/cors","source":"cna","vendor":"@fastify/cors"},"product":"cors","vendor":"fastify"}],"created":"2026-11-02T11:30:14.751026+00:00","updated":"2026-11-03T16:29:25.307021+00:00","vendors":["fastify","fastify$PRODUCT$cors"]},"epss":{"score":0.00291},"mitre":{"cpes":[],"created":"2026-11-02T10:20:47.667000+00:00","description":"@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/120xxx/CVE-2026-120215.json","references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-cors/security/advisories/GHSA-8c3j-mm64-257c"],"title":"@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook","updated":"2026-11-02T17:04:11.417000+00:00","vendors":[],"weaknesses":["CWE-248"]},"nvd":{"cpes":[],"created":"2026-11-02T11:17:31.413000+00:00","description":"@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-120215.json","references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-cors/security/advisories/GHSA-8c3j-mm64-257c"],"title":null,"updated":"2026-11-02T17:17:39.737000+00:00","vendors":[],"weaknesses":["CWE-248"]},"opencve":{"changes":[{"created":"2026-11-02T10:30:00+00:00","data":[{"details":{"new":"@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.","old":null},"type":"description"},{"details":{"new":"@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook","old":null},"type":"title"},{"details":{"added":["CWE-248"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-cors/security/advisories/GHSA-8c3j-mm64-257c"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"576bab92-9ed3-4716-87c0-213fd26335b4"},{"created":"2026-11-02T17:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"857804d5-dc0d-48c9-8adc-68d0a25f37a7"},{"created":"2026-11-03T17:00:00+00:00","data":[{"details":["fastify","fastify$PRODUCT$cors"],"type":"first_time"},{"details":{"added":["fastify","fastify$PRODUCT$cors"],"removed":[]},"type":"vendors"}],"id":"41851086-4178-4e0b-b92f-891f9682890c"},{"created":"2026-11-05T00:30:00+00:00","data":[{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-120215","https://www.cve.org/CVERecord?id=CVE-2026-120215"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Low","old":null}}},"type":"metrics"}],"id":"8a4dd051-53e2-4de0-93f6-7d595c18832a"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-02T10:20:47+00:00","provider":"redhat"},"description":{"data":"@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00291},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":"Low","provider":"redhat"}},"references":{"data":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-cors/security/advisories/GHSA-8c3j-mm64-257c","https://nvd.nist.gov/vuln/detail/CVE-2026-120215","https://www.cve.org/CVERecord?id=CVE-2026-120215"],"providers":["mitre","nvd","redhat"]},"title":{"data":"@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook","provider":"mitre"},"updated":{"data":"2026-11-03T16:29:25.307021+00:00","provider":"enrichment"},"vendors":{"data":["fastify","fastify$PRODUCT$cors"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-248"],"providers":["mitre","nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-11-02T10:20:47+00:00","description":"@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"threat_severity":"Low"},"redhat_repo_path":"2026/CVE-2026-120215.json","references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-cors/security/advisories/GHSA-8c3j-mm64-257c","https://nvd.nist.gov/vuln/detail/CVE-2026-120215","https://www.cve.org/CVERecord?id=CVE-2026-120215"],"title":"@fastify/cors: @fastify/cors: Denial of Service via CORS preflight requests","updated":"2026-11-02T10:20:47+00:00","vendors":[],"weaknesses":["CWE-248"]},"vulnrichment":{"cpes":[],"created":"2026-11-02T10:20:47.667000+00:00","description":"@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook","updated":"2026-11-02T17:04:03.074000+00:00","vendors":[],"vulnrichment_repo_path":"2026/120xxx/CVE-2026-120215.json","weaknesses":[]}}