Executive brief
A vulnerability in a Fastify plugin used for handling web request formats could allow an attacker to crash the server. By sending a large number of specially crafted web requests, an attacker can force the server to use up all its available memory. This results in a denial-of-service condition, making the application unavailable to legitimate users.
Technical details
The @fastify/accepts-serializer plugin fails to implement a size limit or eviction policy for its internal cache used to store serializer-selection results. The cache is keyed by the 'Accept' request header; consequently, a remote unauthenticated attacker can send numerous requests with unique Accept header variants to cause unbounded memory consumption. This leads to Node.js heap exhaustion and a process crash (CWE-770). The issue is resolved in version 6.0.4, which introduces a Least Recently Used (LRU) cache with a default limit of 100 entries.
Affected products
- Fastify @fastify/accepts-serializer <= 6.0.3
Timeline
- 2026-05-04: disclosed
- 2026-05-04: advisory
- 2026-05-04: patched