Low severity3.7NVD Advisory· Published Feb 3, 2026· Updated Jun 17, 2026
CVE-2026-25224
CVE-2026-25224
Description
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fastifynpm | < 5.7.3 | 5.7.3 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37nvdPatchWEB
- github.com/advisories/GHSA-mrq3-vjjr-p77cghsaADVISORY
- github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77cnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-25224ghsaADVISORY
- hackerone.com/reports/3524779nvdPermissions RequiredWEB
News mentions
0No linked articles in our index yet.