Fastify exposes an uncaught exception when a streaming response starts, then remains open beyond the configured handlerTimeout. When the timeout fires, Fastify attempts to send a second error response on a response that has already begun, which triggers an ERR_HTTP_HEADERS_SENT exception and crashes the Node.js process. This failure is confined to availability, with no data disclosure or modification. The weakness corresponds to improper exception handling and is identified as CWE-248.

The issue affects releases of the Fastify framework from version 5.8.0 up to and including 5.12.7. Users running any of these versions on Node.js applications with non‑default handlerTimeout settings are impacted. The default handlerTimeout of 0 is not affected.

The CVSS v3 score is 5.9, indicating a moderate severity. The EPSS metric is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that there are no publicly known exploits at the time of analysis. Because the flaw requires a non‑zero handlerTimeout, an attacker must first be able to send a request to a streaming endpoint with a long‑running stream; this can be done by any unauthenticated external client. The attack can be launched remotely and will terminate the process, disrupting all other in‑flight requests. The overall risk is moderate if non‑default timeouts are used; if the framework runs with the default timeout, the risk is effectively zero.