CVE-2026-7768: @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.
Other sources
Impact
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded. Under sustained load, this can exhaust the Node.js heap and crash the process.
Patches
Update to @fastify/accepts-serializer >= 6.0.4. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new cacheSize plugin option.
Workarounds
None. Upgrade is required.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@fastify/accepts-serializerto a version that resolves this vulnerability.Fixed in 6.0.4 - Upgrade
Upgrade
@fastify/accepts-serializerto a version that resolves this vulnerability.Fixed in 6.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7768?
CVE-2026-7768 is classified as a Denial of Service vulnerability.
How do I fix CVE-2026-7768?
To fix CVE-2026-7768, update @fastify/accepts-serializer to version 6.0.4 or later.
What does CVE-2026-7768 affect?
CVE-2026-7768 affects the @fastify/accepts-serializer package versions up to and including 6.0.3.
What type of attack is possible with CVE-2026-7768?
CVE-2026-7768 allows for a Denial of Service attack due to unbounded Accept header cache growth.
Is authentication required to exploit CVE-2026-7768?
No, a remote unauthenticated client can exploit CVE-2026-7768.