@fastify/cors vulnerabilities

Products

• @fastify/cors 1

Latest @fastify/cors CVEs

Newest publication first

1. CVE-2026-120215 @fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook

   Published 2026-11-02

   Low·CVSS 3.7 EPSS 0.29%

   @fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.