CVE-2026-7768

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.

• CWE-770

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmgVendor Advisory

Published

May 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77650The append-only-vec crate 0.1.9 for Rust can trigger executi…9.8
• CVE-2026-77651The arrayref crate 0.3.10 for Rust can trigger execution of …9.8
• CVE-2026-77652A heap-based buffer overflow vulnerability exists in the Dia…7.8
• CVE-2026-77654Improper Privilege Management vulnerability in Horizon Secur…6.1
• CVE-2026-77658A stack-based buffer overflow vulnerability exists in the Di…7.8
• CVE-2026-7766Kenik Camera management Panel is vulnerable to Path Traversa…8.3
• CVE-2026-77680An algorithmic complexity flaw exists in libsoup's HTTP Rang…5.3
• CVE-2026-77681A vulnerability was identified in CodeAstro Online Job Porta…6.3
• CVE-2026-77683A security flaw has been discovered in Comfast CF-N1-S 2.6.0…9.9
• CVE-2026-77686A weakness has been identified in Dolibarr up to 23.0.4. Thi…5.4
• CVE-2026-77689The Booking for Appointments and Events Calendar WordPress …5.3
• CVE-2026-7769IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1…8.1