@fastify/cors, the CORS plugin for the Fastify web framework, contains a flaw when the non‑default onSend hook is used. On a CORS preflight (an OPTIONS request that includes Origin and Access-Control-Request-Method headers) the plugin calls reply.send from inside the onSend hook, re‑entering the send pipeline. This attempts to write response headers twice, triggering an uncaught ERR_HTTP_HEADERS_SENT exception that can crash the Node.js process if no process‑level error handler is present. The vulnerability is a pure availability issue; an unauthenticated attacker can trigger it with a single preflight request, and exploitation requires the offending onSend configuration. The weakness is a form of improper error handling, mapped to CWE‑248.

The affected product is the @fastify/cors package. Versions from 8.2.0 up to and including 11.3.x are vulnerable. The issue was resolved in version 11.4.0, which rejects onSend as a hook parameter and fails registration with a clear error, preventing runtime crashes. Users of Fastify should therefore update their @fastify/cors dependency to 11.4.0 or later, or adjust the configuration to avoid the removed hook.

The CVSS base score of 3.7 places the vulnerability in the low‑to‑moderate severity range. Exploitation is easy: a remote client can send a crafted OPTIONS request to any endpoint that has @fastify/cors registered with a non‑default onSend hook. No authentication is required and no privilege escalation is needed, but the impact is termination of the Node.js process, which may disrupt service availability. The EPSS score is not available, and the vulnerability is currently not included in the CISA KEV catalog, indicating no known widespread exploitation.