EUVD-2026-27131
GHSA-qxhc-wx3p-2wmg
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Blast Radius
ecosystem impact- 1 npm packages depend on @fastify/accepts-serializer (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 6.0.4.
DescriptionNVD
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.
AnalysisAI
Unbounded cache growth in @fastify/accepts-serializer versions ≤6.0.3 allows remote unauthenticated attackers to exhaust Node.js heap memory by sending numerous distinct Accept header variants, crashing the application. The plugin caches serializer selections keyed by Accept header without size limits, enabling trivial memory exhaustion attacks against any exposed Fastify endpoint. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Fastify deployments and identify those using @fastify/accepts-serializer ≤6.0.3 (check package-lock.json and npm list output). Within 7 days: Upgrade affected applications to @fastify/accepts-serializer version 6.0.4 or later, which implements an LRU cache with 100-entry limits. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today