Description
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.
INFO
Published Date :
2026-02-03T21:21:35.437Z
Last Modified :
2026-02-04T16:20:32.845Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-25224 vulnerability.
| Vendors | Products |
|---|---|
| Fastify |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25224.
