What’s Vulnerable › Vulnerabilities

CVE-2026-25224: Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-770

Description

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.

Affected products

• fastify: before 5.7.3 — fixed in 5.7.3

How to fix

Upgrade to a fixed version: fastify 5.7.3. Check the vendor advisory for mitigations.

References

• https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37
• https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c
• https://hackerone.com/reports/3524779

Get alerted when CVE-2026-25224 or the next vulnerability affects your stack