PT-2026-5743 · Fastify · Fastify
Mcollina
·
Publicado
2026-02-02
·
Atualizado
2026-02-10
·
CVE-2026-25224
CVSS v3.1
3.7
Baixa
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Fastify versions prior to 5.7.3
Description
Fastify is a web framework for Node.js. A denial-of-service condition exists in Fastify’s Web Streams response handling. A slow or non-reading client can cause unbounded buffering when backpressure is ignored, potentially leading to process crashes or significant performance degradation. Applications utilizing
reply.send() to return a ReadableStream or a Response with a Web Stream body are susceptible. The issue can allow a remote client to exhaust server memory.Recommendations
Versions prior to 5.7.3 should be upgraded to version 5.7.3 or later.
As a workaround, avoid sending Web Streams from Fastify responses (e.g.,
ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead.Exploit
Correção
DoS
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fastify