CVE-2026-25224
lowPriorität · verfolgen · 0EPSS 0.006 · 46. PerzentilEUUSEPSS · bewertet 2026-10-27
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-mrq3-vjjr-p77cFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream2026-02-02ghsa · osvUS
### Impact A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a `ReadableStream` (or `Response` with a Web Stream body) via `reply.send()` are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. ### Patches The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later. ### Workarounds Avoid sending Web Streams from Fastify responses (e.g., `ReadableStream` or `Response` bodies). Use Node.js streams (`stream.Readable`) or buffered payloads instead until the project can upgrade. ### References - https://hackerone.com/reports/3524779
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37cnnvd
- https://github.com/fastify/fastify/releasesPatchcnnvd
- https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77ccnnvd
- https://hackerone.com/reports/3524779cnnvd
- https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37enisa_euvd
- https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77cenisa_euvd
- https://hackerone.com/reports/3524779enisa_euvd
- https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37Patchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan