GitHub Advisoryadvisory · npm
GHSA-mrq3-vjjr-p77c Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
LOW
Official page ↗
- Aliases
- CVE-2026-25224
- Ecosystem
- npm
- Packages
- fastify
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-770
- Reviewed
- 2026-02-02
Affected packages
• npm fastify: < 5.7.3 → fixed in 5.7.3
Description
Impact
A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a `ReadableStream` (or `Response` with a Web Stream body) via `reply.send()` are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.
Patches
The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.
Workarounds
Avoid sending Web Streams from Fastify responses (e.g., `ReadableStream` or `Response` bodies). Use Node.js streams (`stream.Readable`) or buffered payloads instead until the project can upgrade.
References
• https://hackerone.com/reports/3524779
Related
Alias · CVE (1)
- CVE-2026-25224 Fastify is a fast and low overhead web framework, for Node.js. vulnerability
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c web
- https://nvd.nist.gov/vuln/detail/CVE-2026-25224 advisory
- https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37 web
- https://hackerone.com/reports/3524779 web
- https://github.com/fastify/fastify package