What is the CVSS score of CVE-2026-7768?

CVE-2026-7768 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of @fastify/accepts-serializer are affected by CVE-2026-7768?

The @fastify/accepts-serializer plugin versions 6.0.3 and earlier are vulnerable to remote denial-of-service attacks where attackers can crash Node.js applications by exhausting heap memory through…. A patch is available.

How to fix or mitigate CVE-2026-7768?

Within 24 hours: Inventory all Fastify deployments and identify those using @fastify/accepts-serializer ≤6.0.3 (check package-lock.json and npm list output). Within 7 days: Upgrade affected applications to @fastify/accepts-serializer version 6.0.4 or later, which implements an LRU cache with 100-entry limits. Within 30 days: Verify upgrades in production environments and conduct load testing to confirm memory behavior under high Accept header variance.

@fastify/accepts-serializer CVE-2026-7768

EUVD-2026-27131 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-04 openjs

GHSA-qxhc-wx3p-2wmg

Denial Of Service Node.js

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

May 04, 2026 - 21:02 EUVD

Analysis Generated

May 04, 2026 - 20:00 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @fastify/accepts-serializer (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.0.4.

DescriptionCVE.org

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.

AnalysisAI

Unbounded cache growth in @fastify/accepts-serializer versions ≤6.0.3 allows remote unauthenticated attackers to exhaust Node.js heap memory by sending numerous distinct Accept header variants, crashing the application. The plugin caches serializer selections keyed by Accept header without size limits, enabling trivial memory exhaustion attacks against any exposed Fastify endpoint. Fix available in version 6.0.4, which implements an LRU cache with 100-entry default limit. No public exploit code identified at time of analysis, but attack is straightforward to execute with basic HTTP tools.

Technical ContextAI

The @fastify/accepts-serializer plugin for Fastify framework optimizes content negotiation by caching serializer-selection decisions based on HTTP Accept headers. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling) - the cache implementation prior to 6.0.4 stored mappings in an unbounded in-memory structure without eviction policy. Since Accept headers can contain arbitrary media type lists with quality parameters (e.g., application/json;q=0.9, text/html;q=0.8), attackers can generate functionally equivalent but textually distinct headers that each create a new cache entry. In Node.js environments, uncontrolled heap growth eventually triggers out-of-memory exceptions, terminating the process. The CPE identifier cpe:2.3:a:@fastify/accepts-serializer:@fastify/accepts-serializer confirms the affected component is the npm package itself, impacting any Fastify application using this plugin for content negotiation.

RemediationAI

Upgrade @fastify/accepts-serializer to version 6.0.4 or later, which implements an LRU (Least Recently Used) cache with default 100-entry limit as documented in GitHub advisory GHSA-qxhc-wx3p-2wmg. Update package.json dependency and run npm install or yarn install, then restart Node.js processes. If immediate upgrade is blocked, implement compensating controls: (1) deploy reverse proxy (nginx, Cloudflare) to normalize/limit Accept header variations before reaching Node.js backend - configure max header size of 4KB and rate-limit distinct header patterns per IP (trade-off: complex regex rules, potential legitimate traffic blocking); (2) enable Node.js --max-old-space-size flag with monitoring to detect heap exhaustion before crash and trigger graceful restart (trade-off: service interruption still occurs, just more controlled); (3) restrict application exposure to authenticated clients only via API gateway (trade-off: eliminates public API use cases). Primary fix of upgrading to 6.0.4 has no known side effects and maintains backward compatibility while adding configurable cacheSize option for custom tuning.