CVE-2026-25224: Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

February 2, 2026 (updated February 4, 2026)

A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.

References

github.com/advisories/GHSA-mrq3-vjjr-p77c
github.com/fastify/fastify
github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37
github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c
hackerone.com/reports/3524779
nvd.nist.gov/vuln/detail/CVE-2026-25224

Code Behaviors & Features

Detect and mitigate CVE-2026-25224 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →