CVE WATCH / VULNERABILITY DETAIL
CVE-2026-120215
LOWCVSS 3.7NVD feed
Published 2 November 2026 · tracked since 2 November 2026
Description
@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog