@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

HIGH 7.5CVE-2026-7768 · GHSA-qxhc-wx3p-2wmg · Published 04/05/2026 · updated 17/06/2026

In short

CVE-2026-7768 is a HIGH (CVSS 7.5) vulnerability affecting fastify/accepts-serializer (fastify), @fastify/accepts-serializer.
Chance of exploitation in the next 30 days (EPSS): 0.28%, higher than 21.0% of all vulnerabilities.
Fix: update to 6.0.4 or later.

Package	Affected versions	Patched versions
fastify/accepts-serializer fastify	`< 6.0.4`	`6.0.4`
@fastify/accepts-serializer npm	`< 6.0.4`	`6.0.4`

Description

Impact

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded. Under sustained load, this can exhaust the Node.js heap and crash the process.

Patches

Update to @fastify/accepts-serializer >= 6.0.4. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new cacheSize plugin option.

Workarounds

None. Upgrade is required.

NVD description

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.

References

fastify/fastify-accepts-serializer security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-7768 · ADVISORY
cna.openjsf.org/security-advisories.html · WEB
fastify/fastify-accepts-serializer · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fastify/accepts-serializer

fastify

< 6.0.4

6.0.4

@fastify/accepts-serializer

npm

< 6.0.4

6.0.4

Description

Impact

Patches

Update to @fastify/accepts-serializer >= 6.0.4. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new cacheSize plugin option.

Workarounds

None. Upgrade is required.

NVD description