VDB
Sign up
HIGH7.5

GHSA-qxhc-wx3p-2wmg

@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

Quick fix

GHSA-qxhc-wx3p-2wmg — @fastify/accepts-serializer: upgrade to the fixed version with the command below.

npm install @fastify/accepts-serializer@6.0.4

Details

### Impact

`@fastify/accepts-serializer` cached serializer-selection results keyed by the request `Accept` header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching `Accept` header variants to make the cache grow unbounded. Under sustained load, this can exhaust the Node.js heap and crash the process.

### Patches

Update to `@fastify/accepts-serializer >= 6.0.4`. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new `cacheSize` plugin option.

### Workarounds

None. Upgrade is required.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@fastify/accepts-serializer
Introduced in: 0Fixed in: 6.0.4
Fixnpm install @fastify/accepts-serializer@6.0.4

References