CVE-2026-25224: Fastify Denial of Service Vulnerability via Unbounded Memory Allocation
Summary
CVE-2026-25224: Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream. Affects fastify versions < 5.7.3. Fixed in 5.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed for building efficient and high-performance web applications. It provides a robust set of features, including support for asynchronous programming, routing, and middleware. However, it has a vulnerability in its Web Streams response handling, which can lead to severe memory exhaustion under certain conditions.
Vulnerability Detail
The vulnerability arises from Fastify's handling of Web Streams in responses. When a remote client sends data at a slow rate or does not read the data, the server may enter a state of unbounded buffering. This occurs because the backpressure mechanism is ignored, allowing the server's memory to be exhausted. As a result, this can lead to Denial of Service (DoS) conditions, where the application crashes or experiences significant performance degradation.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.7.3
This is the first release that contains the fix.
npm install fastify@5.7.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid sending Web Streams from Fastify responses. Instead, consider using Node.js streams (e.g., stream.Readable) or buffered payloads. Here is an example of using Node.js streams:
const { Readable } = require('stream');
const readableStream = new Readable({
read() {
this.push('data');
this.push(null);
}
});
reply.send(readableStream);
Conclusion
In summary, Fastify has a vulnerability (CVE-2026-25224) that can lead to Denial of Service due to unbounded memory allocation when handling Web Streams. Users are advised to upgrade to version 5.7.3 or later to mitigate this risk. Temporary workarounds include using Node.js streams instead of Web Streams.
See every vulnerability recorded for fastify →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Web Streams are a standard for handling streaming data in web applications, allowing for efficient data processing and transfer.
If left unaddressed, this vulnerability can lead to Denial of Service, causing your application to crash or slow down significantly.
Yes, the permanent fix is to upgrade to Fastify version 5.7.3 or later, where the issue has been resolved.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
