PT-2026-36915 · Npm · @Fastify/Accepts-Serializer

Manuel Spigolon + 2 · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7768

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @fastify/accepts-serializer versions prior to 6.0.4

Description An issue exists where serializer-selection results are cached using the request Accept header as a key without a size limit or eviction policy. A remote unauthenticated client can send numerous distinct but matching Accept header variants, causing the cache to grow unbounded. This can lead to the exhaustion of the Node.js heap and result in a process crash, causing a Denial of Service (DoS).

Recommendations Update to version 6.0.4 or later.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-7768

Affected Products

@Fastify/Accepts-Serializer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-7768 · Security Note
• https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmg · Note
• https://twitter.com/kom_256/status/2051381663934878122 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051405609845612683 · Twitter Post
• https://twitter.com/CVEnew/status/2051403825974476815 · Twitter Post
• https://cna.openjsf.org/security-advisories.html · Note