GitHub Advisoryadvisory · npm

GHSA-qxhc-wx3p-2wmg @fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

HIGH Published 2026-05-08 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-7768
Ecosystem
npm
Packages
@fastify/accepts-serializer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-05-08

Affected packages

• npm @fastify/accepts-serializer: < 6.0.4 → fixed in 6.0.4

Description

Impact `@fastify/accepts-serializer` cached serializer-selection results keyed by the request `Accept` header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching `Accept` header variants to make the cache grow unbounded. Under sustained load, this can exhaust the Node.js heap and crash the process. Patches Update to `@fastify/accepts-serializer >= 6.0.4`. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new `cacheSize` plugin option. Workarounds None. Upgrade is required.

Related

Alias · CVE (1)

  • CVE-2026-7768 @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References