Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

The core impact of CVE-2026-25224 lies in its potential to exhaust server memory. An attacker can craft a request that utilizes Fastify's Web Streams response handling in a way that prevents the server from properly managing backpressure. This leads to the server continuously buffering data intended for a slow or unresponsive client. Over time, this unbounded buffering can consume all available memory, resulting in a denial of service. The blast radius extends to any application relying on Fastify for its web server functionality, particularly those utilizing reply.send() with ReadableStream or Response bodies. While no active exploitation has been publicly reported, the ease of triggering the vulnerability makes it a potential target for opportunistic attacks.

Applications built with Fastify 5.x that utilize Web Streams for response handling are at risk. This includes applications serving large files or streaming data, particularly those deployed in environments with limited resources or where input validation is insufficient. Shared hosting environments running Fastify applications are also potentially vulnerable.

• nodejs / server:

ps aux | grep -i fastify | grep -i 'readableStream'

• nodejs / server:

journalctl -u fastify -f | grep -i 'backpressure'

• generic web: Use a load testing tool (e.g., ApacheBench) to send a large, slow stream to Fastify endpoints and monitor server memory usage. Look for sustained increases in memory consumption.

1. 2026-02-02Disclosure

   disclosure

1. Réservé2026-01-30
2. Publiée2026-02-02
3. Modifiée2026-02-04
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-25224 is to upgrade Fastify to version 5.7.3 or later, which includes the fix. If immediate upgrading is not feasible, a workaround involves avoiding the use of Web Streams in Fastify responses. Specifically, refrain from sending ReadableStream objects or Response objects with Web Stream bodies via reply.send(). Consider alternative response formats like plain text or JSON. While not a complete solution, this can significantly reduce the attack surface. There are no specific WAF rules or detection signatures readily available for this vulnerability, as it stems from application-level behavior. After upgrading, confirm the fix by sending a large, slow stream to the Fastify endpoint and monitoring server memory usage.