CVE-2026-7768: Fastify Accepts Serializer DoS Vulnerability

CVE-2026-7768 Overview

CVE-2026-7768 affects the @fastify/accepts-serializer plugin for the Fastify Node.js web framework. The plugin cached serializer-selection results keyed by the request Accept header without enforcing a size limit or eviction policy. A remote unauthenticated attacker can send numerous distinct but matching Accept header variants to grow the cache without bound. This exhausts the Node.js heap and crashes the process, producing a denial-of-service condition. Versions <= 6.0.3 are affected. The maintainers released version 6.0.4, which bounds the cache via a least-recently-used (LRU) policy with a default size of 100 entries, configurable through the new cacheSize plugin option. The flaw is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact

Unauthenticated remote attackers can crash Fastify processes using @fastify/accepts-serializer <= 6.0.3 by triggering unbounded heap growth through crafted Accept headers.

Affected Products

• @fastify/accepts-serializer versions <= 6.0.3
• Node.js applications using the Fastify framework with this plugin enabled
• Any HTTP service exposing routes that perform Accept-based content negotiation through the plugin

Discovery Timeline

• 2026-05-04 - CVE-2026-7768 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-7768

Vulnerability Analysis

The @fastify/accepts-serializer plugin selects a response serializer based on the client's Accept header. To avoid recomputing this selection on every request, the plugin caches the resolved serializer using the raw Accept header value as the cache key. The cache had no maximum size and no eviction policy, so each new key persisted in memory for the lifetime of the process.

The Accept header supports complex syntax including media ranges, quality values (q=), and parameters. This grammar allows a virtually unlimited number of header strings that all resolve to the same serializer. An attacker can issue requests with semantically equivalent but lexically distinct headers, causing each unique string to populate a new cache entry.

Root Cause

The root cause is missing resource throttling on a server-side cache whose key space is fully controlled by the remote client. The plugin trusted the cardinality of Accept header values to remain small in practice. No bound on cache size, total memory, or entry lifetime was enforced.

Attack Vector

The vulnerability is reachable over the network without authentication or user interaction. An attacker sends repeated HTTP requests to any route handled by the plugin, varying the Accept header on each request. Trivial variations such as adding whitespace, reordering media types, or appending unique parameters produce distinct cache keys. As entries accumulate, the Node.js process consumes increasing heap memory until V8 aborts the process with an out-of-memory error, terminating availability for all clients. Refer to the GitHub Security Advisory GHSA-qxhc-wx3p-2wmg for additional context.

Detection Methods for CVE-2026-7768

Indicators of Compromise

• • Sustained growth of Node.js resident set size (RSS) and V8 heap usage on processes loading @fastify/accepts-serializer
• • Process termination with FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
• • High volume of HTTP requests from a single source carrying many distinct Accept header values
• • Unusual entropy or cardinality in the Accept header field across short time windows in access logs

Detection Strategies

• • Inventory package.json and package-lock.json files across deployments to identify any @fastify/accepts-serializer version at or below 6.0.3.
• • Aggregate access logs and alert when the count of distinct Accept header values per source IP exceeds a baseline threshold over a five-minute window.
• • Instrument the application with Node.js metrics (process.memoryUsage(), v8.getHeapStatistics()) and alert on rapid heap growth uncorrelated with traffic volume.

Monitoring Recommendations

• • Forward Node.js process telemetry and HTTP access logs to a centralized analytics platform for correlation between header diversity and memory pressure.
• • Track process restart events and out-of-memory exit codes in container orchestration platforms such as Kubernetes.
• • Enable rate-limit metrics at the reverse proxy or API gateway and review spikes attributable to single clients.

How to Mitigate CVE-2026-7768

Immediate Actions Required

• • Upgrade @fastify/accepts-serializer to version 6.0.4 or later in all affected services.
• • Audit dependency trees with npm ls @fastify/accepts-serializer or yarn why @fastify/accepts-serializer to find transitive uses.
• • Set the new cacheSize plugin option explicitly to a value appropriate for the workload, rather than relying on defaults.
• • Apply rate limiting at the edge to constrain how many distinct requests a single client can send per minute.

Patch Information

The fix is delivered in @fastify/accepts-serializer6.0.4. The patched version replaces the unbounded object cache with an LRU cache that defaults to 100 entries. Operators can tune capacity through the cacheSize option when registering the plugin. See the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-qxhc-wx3p-2wmg for advisory details.

Workarounds

• • Place a reverse proxy in front of Fastify that normalizes or strips the Accept header before it reaches the application.
• • Enforce per-IP request rate limits and connection caps using @fastify/rate-limit or an upstream WAF.
• • Restart application processes on a schedule or based on heap thresholds until the upgrade is deployed.
• • Disable the @fastify/accepts-serializer plugin on routes where content negotiation is not required.

# Configuration example
npm install @fastify/accepts-serializer@^6.0.4

# Register with an explicit cache bound
# fastify.register(require('@fastify/accepts-serializer'), {
#   serializers: [...],
#   default: 'application/json',
#   cacheSize: 64
# })