Threats affecting pkg:npm/fastify

A vulnerability in fastify versions 5.8.0 through 5.12.7 causes the server to crash when a streaming response exceeds a configured nonzero handlerTimeout. This occurs because Fastify attempts to send an error response after headers have already been sent, triggering an uncaught exception that terminates the Node.js process and disrupts other requests. The issue affects availability and can be triggered remotely without authentication. The default handlerTimeout of 0 is not affected. The vulnerability is fixed in version 5.12.8.