CVE-2026-25224: Fastify

Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days.

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in version 5.7.3.

Affected products

• Fastify Fastify: before 5.7.3 (fixed in 5.7.3)

Published 2026-02-03. Last modified 2026-06-17.