PT-2026-5743 · Fastify · Fastify
Mcollina
·
Published
2026-02-02
·
Updated
2026-02-10
·
CVE-2026-25224
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Fastify versions prior to 5.7.3
Description
Fastify is a web framework for Node.js. A denial-of-service condition exists in Fastify’s Web Streams response handling. A slow or non-reading client can cause unbounded buffering when backpressure is ignored, potentially leading to process crashes or significant performance degradation. Applications utilizing
reply.send() to return a ReadableStream or a Response with a Web Stream body are susceptible. The issue can allow a remote client to exhaust server memory.Recommendations
Versions prior to 5.7.3 should be upgraded to version 5.7.3 or later.
As a workaround, avoid sending Web Streams from Fastify responses (e.g.,
ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fastify