CVE-2026-7768 @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
Remote attackers can crash the application by exhausting memory through unbounded cache growth caused by varied Accept headers in the Fastify accepts-serializer plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7768?
CVE-2026-7768 is a high-severity denial of service vulnerability in @fastify/accepts-serializer, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.
Weakness: CWE-770
Which versions are affected by CVE-2026-7768?
2 open source packages ship an affected version, including @fastify/accepts-serializer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/accepts-serializer npm | All versions | 6.0.4 |
@fastify/accepts-serializer npm | All versions | 6.0.4 |
Products include Fastify Fastify\/Accepts-Serializer.
How do I fix CVE-2026-7768?
Upgrade @fastify/accepts-serializer to 6.0.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-7768 being exploited?
There is no known exploitation of CVE-2026-7768 in the wild and no public exploit code.
Sources
Also known as GHSA-qxhc-wx3p-2wmg.