Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-25224: Fastify can let a client exhaust server memory

CVE-2026-25224 · published 9 months ago

Summary

Versions of Fastify before 5.7.3 may fill up server memory when a client receives a streamed response and reads it very slowly or not at all. This can cause the application to crash or become very slow. Upgrade to Fastify 5.7.3 or later to stop the problem.

What to do

Update eomm fastify to version 5.7.3.
Update fastify fastify to version 5.7.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	eomm	fastify	<= 5.7.2 Fix: upgrade to 5.7.3
–	fastify	fastify	< 5.7.3 `cpe:2.3:a:fastify:fastify::::::node.js::*`

Original advisory text

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.

References

https://github.com/advisories/GHSA-mrq3-vjjr-p77c
https://nvd.nist.gov/vuln/detail/CVE-2026-25224 Vendor Advisory
https://hackerone.com/reports/3524779 URL
https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25224... Vendor Advisory
https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published3 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-25224 · NVD

GHSA-mrq3-vjjr-p77c · GHSA

CVE-2026-25224 · OSV

Track software like this

Free during beta