CVE-2018-3711 Denial of Service vulnerability with large JSON payloads in fastify

What is CVE-2018-3711?

CVE-2018-3711 is a high-severity denial of service vulnerability in HackerOne fastify node module, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload.

Weakness: CWE-770

Which versions are affected by CVE-2018-3711?

2 open source packages ship an affected version, including fastify. It affects 1 product.

Products include Fastify Fastify.

How do I fix CVE-2018-3711?

Upgrade fastify to 0.38.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-3711 being exploited?

There is no known exploitation of CVE-2018-3711 in the wild and no public exploit code.

Other vulnerabilities in HackerOne fastify node module

• CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision High 8.1
• CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers High 7.5
• CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization High 7.5
• CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas High 7.5
• CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mq6c-fh97-4gwv.