Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.
References
| Link | Resource |
|---|---|
| https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37 | Patch |
| https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c | Vendor Advisory |
| https://hackerone.com/reports/3524779 | Permissions Required |
Configurations
History
10 Feb 2026, 19:24
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:* | |
| First Time |
Fastify fastify
Fastify |
|
| References | () https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37 - Patch | |
| References | () https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c - Vendor Advisory | |
| References | () https://hackerone.com/reports/3524779 - Permissions Required |
03 Feb 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-03 22:16
Updated : 2026-02-10 19:24
NVD link : CVE-2026-25224
Mitre link : CVE-2026-25224
CVE.ORG link : CVE-2026-25224
JSON object : View
Products Affected
fastify
- fastify
CWE
CWE-770
Allocation of Resources Without Limits or Throttling