CVE-2026-7768
High
Description
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.
SeverityHigh
CVSS7.5
Exploit probability—
Product
@fastify/accepts-serializer
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- @fastify/accepts-serializer6.0.4 or later
- fastify fastify\/accepts-serializer6.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @fastify/accepts-serializernpm | v < 6.0.4 | 6.0.4 |
| fastify fastify\/accepts-serializer | v < 6.0.4 | 6.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.