@fastify/cors vulnerabilities

CVEs whose affected-version data names the @fastify/cors package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120215Low· 3.7

6d ago

@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that ca…

▾ Sunlit@fastify/cors · @fastify/corsEPSS 0.29%via CVEORG