CVE-2026-7768

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.

• CWE-770

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmgVendor Advisory

Published

May 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7761The Ultimate Member plugin for WordPress is vulnerable to Ac…8.8
• CVE-2026-7762A heap-based buffer overflow vulnerability in the dot11ah.ko…9.8
• CVE-2026-7763A heap-based buffer overflow vulnerability in the morse.ko H…9.8
• CVE-2026-7764An out-of-bounds read vulnerability in the morse.ko HaLow Wi…6.8
• CVE-2026-7765Incorrect authorization in the User Messages dashboard widge…5.3
• CVE-2026-7766Kenik Camera management Panel is vulnerable to Path Traversa…8.3
• CVE-2026-7769IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1…8.1
• CVE-2026-7770IBM i Access Family 1.1.5.0 through 1.1.9.12 IBM i Access Cl…8.8
• CVE-2026-7771IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is …5.5
• CVE-2026-7774tarfile.data_filter could be bypassed using crafted link ent…6.9
• CVE-2026-7775IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0…4.8
• CVE-2026-7776Boundary Community Edition and Boundary Enterprise (“Boundar…7.5