Is CVE-2026-7768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7768 being exploited in the wild.

How severe is CVE-2026-7768?

High severity, with a CVSS score of 7.5, published 4 May 2026.

Which products and versions are affected?

Fastify Accepts-Serializer <= 6.0.3; @fastify/accepts-serializer (npm) SEMVER:introduced=0,fixed=6.0.4.

Is there a fix for CVE-2026-7768?

Yes. @fastify/accepts-serializer (npm): upgrade to 6.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7768 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7768?

Check whether you run Fastify Accepts-Serializer or @fastify/accepts-serializer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7768: Fastify @fastify/accepts-serializer denial of service via unbounded cache growth

Q: Is there a fix for CVE-2026-7768?

Yes. @fastify/accepts-serializer (npm): upgrade to 6.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-7768 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-7768?

Check whether you run Fastify Accepts-Serializer or @fastify/accepts-serializer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7768 · Severity: high · CVSS 7.5 · Published 2026-05-04

A vulnerability in a Fastify plugin used for handling web request formats could allow an attacker to crash the server. By sending a large number of specially crafted web requests, an attacker can force the server to use up all its available memory. This results in a denial-of-service condition, making the application unavailable to legitimate users.

Vendors: Fastify, npm.

Quick answers

Is CVE-2026-7768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7768 being exploited in the wild.
How severe is CVE-2026-7768?: High severity, with a CVSS score of 7.5, published 4 May 2026.
Which products and versions are affected?: Fastify Accepts-Serializer <= 6.0.3; @fastify/accepts-serializer (npm) SEMVER:introduced=0,fixed=6.0.4.
Is there a fix for CVE-2026-7768?: Yes. @fastify/accepts-serializer (npm): upgrade to 6.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7768 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7768?: Check whether you run Fastify Accepts-Serializer or @fastify/accepts-serializer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@fastify/accepts-serializer (npm): upgrade to 6.0.4 or later
```
npm install @fastify/accepts-serializer@6.0.4
```

Technical details

The @fastify/accepts-serializer plugin fails to implement a size limit or eviction policy for its internal cache used to store serializer-selection results. The cache is keyed by the 'Accept' request header; consequently, a remote unauthenticated attacker can send numerous requests with unique Accept header variants to cause unbounded memory consumption. This leads to Node.js heap exhaustion and a process crash (CWE-770). The issue is resolved in version 6.0.4, which introduces a Least Recently Used (LRU) cache with a default limit of 100 entries.

Affected products

Fastify @fastify/accepts-serializer <= 6.0.3

Identifiers

CVE-2026-7768
GHSA-qxhc-wx3p-2wmg

Timeline

2026-05-04: disclosed
2026-05-04: advisory
2026-05-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.