Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@fastify/accepts-serializer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    @fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

    CVE-2026-7768 · GHSA-qxhc-wx3p-2wmg

    Affected
    • npm @fastify/accepts-serializer <= 6.0.3
    Fixed in
    6.0.4· Vendor fix available
    Issue
    Impact @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded. Under sustained load, this can exhaust the Node.js heap and crash the process. Patches Update to @fastify/accepts-serializer = 6.0.4. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new cacheSize plugin option. Workarounds None. Upgrade is required.

    Recommended action: Upgrade to 6.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →