CVE-2026-7768 @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the...

CVE-2026-7768

The CVE affects @fastify/accepts-serializer where serializer-selection results are cached by the request Accept header without bounds or eviction, allowing an unauthenticated remote client to cause unbounded cache growth and Node.js heap exhaustion leading to a crash. Affected versions are

CVE-2026-7768 @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the...

CVE-2026-7768 @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the...

harperdb (>=4.0.0-rc.1, <=4.0.8) potentially affected by CVE-2026-7768 via @fastify/accepts-serializer (>=5.1.0, <=5.2.0)

@fastify/accepts-serializer NPM version =5.1.0, =4.0.0-rc.1, =4.0.8 Source cves: CVE-2026-7768 Source advisory: MEND:CVE-2026-7768...

PT-2026-36915

Name of the Vulnerable Software and Affected Versions @fastify/accepts-serializer versions prior to 6.0.4 Description An issue exists where serializer-selection results are cached using the request Accept header as a key without a size limit or eviction policy. A remote unauthenticated client can...

@fastify/accepts-serializer security vulnerability

@fastify/accepts-serializer is a plugin developed by Fastify, which automatically selects a serialization method based on the Accept header. Versions of @fastify/accepts-serializer up to 6.0.3 contained security vulnerabilities. These vulnerabilities stemmed from the lack of size limits or evicti...

CVE-2026-7768: Allocation of Resources Without Limits or Throttling

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the...

@clerk/agent-toolkit (>=0.3.1-canary.v20260303211310, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.1-canary.v20260303211310, <=3.0.17-canary.v20260417194309) +10 more potentially affected by CVE-2026-42349 via @clerk/backend (>=3.0.0, <=3.2.13)

@clerk/backend NPM version =3.0.0, =0.3.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =2.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =0.0.3-canary.v20260303211310, =7.0.1-canary.v20260303211310, =2.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310,...

Fastify onRegister Function Use-After-Free

The vulnerability of the onRegister function in the Fastify framework, a Node.js software platform, is related to the occurrence of interpretation conflicts when processing HTTP headers’ names and values. Exploiting this vulnerability allows an attacker to compromise the confidentiality and...

Fastify rewriteRequestHeaders() Unauthenticated Access Modification

The vulnerability of the rewriteRequestHeaders function in the Fastify framework, a Node.js software platform, is related to HTTP request processing flaws. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...

Fastify Node.js enhanceRequest Use-After-Free

The vulnerability of the enhanceRequest function in the Fastify Node.js software framework is related to the occurrence of interpretation conflicts when processing HTTP header names and values. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, an...

EUVD-2026-23243

@fastify/static vulnerable to path traversal in directory listing...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +741 more potentially affected by CVE-2026-6410 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =0.0.18, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-6410 Source advisory: GHSA-PR96-94W5-MX2H...

@fastify/static vulnerable to path traversal in directory listing

Impact @fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path to resolve a directory outside the root via path.join without a containment check. A remote...

GHSA-PR96-94W5-MX2H @fastify/static vulnerable to path traversal in directory listing

Impact @fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path to resolve a directory outside the root via path.join without a containment check. A remote...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +741 more potentially affected by CVE-2026-6410 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =0.0.18, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-6410 Source advisory: OSV:GHSA-PR96-94W5-MX2H...

@fastify/static vulnerable to route guard bypass via encoded path separators

Impact @fastify/static v9.1.0 and earlier decodes percent-encoded path separators %2F before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/ do not match /admin%2Fsecret.html, but @fastify/static decodes it to...

EUVD-2026-23227

@fastify/static vulnerable to route guard bypass via encoded path separators...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +741 more potentially affected by CVE-2026-6414 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =0.0.18, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-6414 Source advisory: GHSA-X428-GHPX-8J92...