CVE-2026-7768

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7768", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-05-04T11:50:02.918Z", "datePublished": "2026-05-04T19:14:36.828Z", "dateUpdated": "2026-05-04T19:50:16.465Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-05-04T19:14:36.828Z"}, "descriptions": [{"lang": "en", "value": "@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option."}]}], "affected": [{"vendor": "@fastify/accepts-serializer", "product": "@fastify/accepts-serializer", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "status": "affected", "version": "0", "lessThan": "6.0.4"}, {"versionType": "semver", "status": "unaffected", "version": "6.0.4"}], "packageURL": "pkg:npm/@fastify/accepts-serializer"}], "references": [{"url": "https://cna.openjsf.org/security-advisories.html"}, {"url": "https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmg"}], "credits": [{"lang": "en", "type": "finder", "value": "Yuki Matsuhashi"}, {"lang": "en", "type": "remediation reviewer", "value": "Ulises Gasc\u00f3n"}, {"lang": "en", "type": "remediation developer", "value": "Manuel Spigolon"}], "title": "@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "x_generator": {"engine": "cve-kit 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T19:50:08.458813Z", "id": "CVE-2026-7768", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T19:50:16.465Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7768", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-04T19:50:08.458813Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T19:50:12.504Z"}}], "cna": {"title": "@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth", "credits": [{"lang": "en", "type": "finder", "value": "Yuki Matsuhashi"}, {"lang": "en", "type": "remediation reviewer", "value": "Ulises Gasc\u00f3n"}, {"lang": "en", "type": "remediation developer", "value": "Manuel Spigolon"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "@fastify/accepts-serializer", "product": "@fastify/accepts-serializer", "versions": [{"status": "affected", "version": "0", "lessThan": "6.0.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.4", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/accepts-serializer", "defaultStatus": "unaffected"}], "references": [{"url": "https://cna.openjsf.org/security-advisories.html"}, {"url": "https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmg"}], "x_generator": {"engine": "cve-kit 1.0.0"}, "descriptions": [{"lang": "en", "value": "@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.", "supportingMedia": [{"type": "text/html", "value": "@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-05-04T19:14:36.828Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7768", "state": "PUBLISHED", "dateUpdated": "2026-05-04T19:50:16.465Z", "dateReserved": "2026-05-04T11:50:02.918Z", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "datePublished": "2026-05-04T19:14:36.828Z", "assignerShortName": "openjs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/@fastify/accepts-serializer", "product": "@fastify/accepts-serializer", "vendor": "@fastify/accepts-serializer", "versions": [{"lessThan": "6.0.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.4", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify\\/accepts-serializer:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "47020EDF-6583-4271-AE38-04FE4EE8F199", "versionEndExcluding": "6.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option."}, {"lang": "es", "value": "@fastify/accepts-serializer almacenaba en cach\u00e9 los resultados de selecci\u00f3n de serializador indexados por el encabezado Accept de la solicitud sin un l\u00edmite de tama\u00f1o o pol\u00edtica de desalojo. Un cliente remoto no autenticado podr\u00eda enviar muchas variantes distintas pero coincidentes del encabezado Accept para hacer que la cach\u00e9 creciera sin l\u00edmites, agotando finalmente el heap de Node.js y bloqueando el proceso. Las versiones menor o igual que 6.0.3 est\u00e1n afectadas. Actualice a la versi\u00f3n 6.0.4 o posterior, que limita la cach\u00e9 mediante un LRU con un tama\u00f1o predeterminado de 100 entradas, configurable a trav\u00e9s de la nueva opci\u00f3n de plugin cacheSize."}], "id": "CVE-2026-7768", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7768", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T19:50:08.458813Z", "version": "2.0.3"}}]}, "published": "2026-05-04T20:16:21.107", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmg"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.0.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "@fastify/accepts-serializer", "source": "cna", "vendor": "@fastify/accepts-serializer"}, "product": "fastify-accepts-serializer", "vendor": "fastify"}], "created": "2026-05-04T20:30:08.152860+00:00", "updated": "2026-05-06T09:22:37.694326+00:00", "vendors": ["fastify", "fastify$PRODUCT$fastify-accepts-serializer"]}