CVE-2026-7768 Details
Description
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.
A denial-of-service vulnerability has been identified in the @fastify/accepts-serializer package, affecting versions through 6.0.3. The issue arises because the package caches serializer-selection results based on the request's Accept header without any size limit or eviction policy. This flaw allows a remote, unauthenticated client to send numerous distinct but matching Accept header variants, causing the cache to grow uncontrollably. Such unbounded growth can lead to exhaustion of the Node.js heap, causing the process to crash.
Users are advised to update to @fastify/accepts-serializer version 6.0.4 or later. The updated version implements a cache limit using an LRU (Least Recently Used) strategy, with a default size of 100 entries. This default size can be adjusted through the new cacheSize plugin option.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmg | openjs | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | openjs |
Affected Products
| Product | Versions |
|---|---|
| fastify fastify/accepts-serializer | < 6.0.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | openjs |