Threats affecting pkg:npm/@fastify/cors

@fastify/cors versions 8.2.0 through 11.3.x have a vulnerability where using the non-default onSend hook option causes the application to crash on CORS preflight OPTIONS requests. This happens because the plugin calls reply.send inside the onSend hook, triggering an uncaught ERR_HTTP_HEADERS_SENT error that can terminate the Node.js process. The issue is fixed in version 11.4.0, which disallows onSend as a hook option and fails registration with a clear error instead of crashing at runtime.