CVE-2026-25224
lowpriority · track · 0EPSS 0.006 · 46 %ileEUUSEPSS · scored 2026-10-27
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-mrq3-vjjr-p77cFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream2026-02-02ghsa · osvUS
### Impact A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a `ReadableStream` (or `Response` with a Web Stream body) via `reply.send()` are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. ### Patches The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later. ### Workarounds Avoid sending Web Streams from Fastify responses (e.g., `ReadableStream` or `Response` bodies). Use Node.js streams (`stream.Readable`) or buffered payloads instead until the project can upgrade. ### References - https://hackerone.com/reports/3524779
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37cnnvd
- https://github.com/fastify/fastify/releasesPatchcnnvd
- https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77ccnnvd
- https://hackerone.com/reports/3524779cnnvd
- https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37enisa_euvd
- https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77cenisa_euvd
- https://hackerone.com/reports/3524779enisa_euvd
- https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan