Unbounded Cache Vulnerability in Fastify Accepts Serializer

CVE-2026-7768

What is CVE-2026-7768?

The Fastify accepts-serializer component suffers from a vulnerability where cached serializer-selection results, based on request Accept headers, are stored without imposed limits. This flaw can be exploited by remote unauthenticated clients who can manipulate Accept headers to generate numerous variants, leading the cache to expand indefinitely. Such cache growth can ultimately exhaust the Node.js heap memory, resulting in a crash of the running process. Users are advised to upgrade to version 6.0.4 or higher, which introduces a bounded Least Recently Used (LRU) cache mechanism, restricting the size to a default of 100 entries, but configurable via a new cacheSize option.

References