{"metadata": {"vulnerability": "CVE-2026-92081", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-15T12:55:43.189Z", "date_only": false, "value": "2026-09-15T12:55:43.189Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-92081", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-16T08:52:49.757Z", "date_only": false, "value": "2026-09-16T08:52:49.757Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92081", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-16T08:52:49.757Z", "date_only": false, "value": "2026-09-16T08:52:49.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-92081", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T09:17:10Z", "date_only": false, "value": "2026-09-16T09:17:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4MH8-R7RC-XPVC", "record": "GHSA-4MH8-R7RC-XPVC", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-16T09:17:10.137Z", "date_only": false, "value": "2026-09-16T09:17:10.137", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92081", "record": "FKIE_CVE-2026-92081", "field": "published"}, {"timestamp": "2026-09-16T09:17:22.031Z", "date_only": false, "value": "2026-09-16T09:17:22.031409Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mvmsl6xvj22a", "record": "CVE-2026-92081", "field": "creation_timestamp", "uuid": "775f71e8-1400-4591-acf7-6958aa0d4417", "content": "\ud83d\udea8 Medium-severity security fix in fastify@5.12.5 just released!\n\nPatches CVE-2026-92081: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses\n\ngithub.com/fastify/fast...", "url": "https://bsky.app/profile/ulisesgascon.com/post/3mvmsl6xvj22a"}, {"timestamp": "2026-09-16T14:00:06.966Z", "date_only": false, "value": "2026-09-16T14:00:06.966478Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92081", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-16T14:00:06.966Z", "date_only": false, "value": "2026-09-16T14:00:06.966478Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92081", "record": "FKIE_CVE-2026-92081", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-16T14:00:59.305Z", "date_only": false, "value": "2026-09-16T14:00:59.305Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-92081", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-16T14:00:59.305Z", "date_only": false, "value": "2026-09-16T14:00:59.305Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92081", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T19:40:00.317Z", "date_only": false, "value": "2026-09-16T19:40:00.317", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92081", "record": "FKIE_CVE-2026-92081", "field": "lastModified"}, {"timestamp": "2026-09-30T23:53:44Z", "date_only": false, "value": "2026-09-30T23:53:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4MH8-R7RC-XPVC", "record": "GHSA-4MH8-R7RC-XPVC", "field": "published"}, {"timestamp": "2026-09-30T23:53:44Z", "date_only": false, "value": "2026-09-30T23:53:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4MH8-R7RC-XPVC", "record": "GHSA-4MH8-R7RC-XPVC", "field": "modified"}, {"timestamp": "2026-10-01T02:30:29Z", "date_only": false, "value": "2026-10-01T02:30:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/787a441b981f5f49f05bb8066f738178", "record": "CVE-2026-92081", "field": "creation_timestamp", "uuid": "016fb0b7-338c-4667-9f6f-ebabc3373d24", "content": "# CVE-2026-92081: CVE-2026-92081: Denial of Service via Uncaught Exception on HTTP/2 Response Trailers in Fastify\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92081\n\n## Summary\nA protocol validation vulnerability exists in Fastify before version 5.12.5. When serving requests over HTTP/2, Fastify unconditionally injects the forbidden Transfer-Encoding header when response trailers are used, triggering an uncaught exception in Node.js and crashing the process.\n\n## TL;DR\nUnauthenticated remote HTTP/2 requests to Fastify endpoints utilizing response trailers trigger an uncaught validation exception in Node.js, immediately crashing the server.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248\n- **Attack Vector**: Network\n- **CVSS Score**: 5.9\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS)\n\n## Affected Systems\n\n- Fastify\n- **Fastify**: < 5.12.5 (Fixed in: `5.12.5`)\n\n## Mitigation\n\n- Upgrade Fastify to version 5.12.5 or later.\n- Disable HTTP/2 support in Fastify configuration if not strictly necessary.\n- Implement conditional trailer registration by verifying the active protocol version before calling reply.trailer().\n\n**Remediation Steps:**\n1. Navigate to the application root directory.\n2. Update the Fastify dependency in package.json to \"^5.12.5\" or run \"npm install fastify@5.12.5\".\n3. Verify that the package-lock.json or yarn.lock file reflects the correct version upgrade.\n4. Deploy the updated application to staging environment and execute verification tests over HTTP/2 connections.\n5. Monitor application logs for uncaughtException events during traffic serialization.\n\n## References\n\n- [GHSA-4mh8-r7rc-xpvc](https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc)\n- [Fastify Patch Commit ad06a4c](https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90)\n- [Fastify Release v5.12.5](https://github.com/fastify/fastify/releases/tag/v5.12.5)\n- [NVD CVE-2026-92081](https://nvd.nist.gov/vuln/detail/CVE-2026-92081)\n- [CVE.org CVE-2026-92081](https://www.cve.org/CVERecord?id=CVE-2026-92081)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92081) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/787a441b981f5f49f05bb8066f738178"}]}