Executive brief
Fastify is a popular Node.js web framework used to build REST APIs and web services. A denial-of-service vulnerability allows remote attackers to exhaust server memory by sending data slowly through Web Stream responses, causing application crashes or severe performance degradation. This impacts applications that stream data directly to clients without proper backpressure handling.
Technical details
The vulnerability is a CWE-770 (Unbounded Resource Allocation) in Fastify's Web Streams response handling. When an application sends a ReadableStream or Response with a Web Stream body via reply.send(), a slow or non-reading client can trigger unbounded memory buffering because backpressure is not properly respected. The attack is network-based, requires no authentication or user interaction, but has high attack complexity. A successful exploit causes denial of service through process crash or server degradation. The issue is patched in Fastify 5.7.3 and later versions.
Affected products
- Fastify Fastify <= 5.7.2
Timeline
- 2026-02-02: disclosed
- 2026-02-02: patched: Fixed in version 5.7.3