GHSA-qxhc-wx3p-2wmg
@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @fastify/accepts-serializer | < 6.0.4 | 6.0.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
`@fastify/accepts-serializer` cached serializer-selection results keyed by the request `Accept` header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching `Accept` header variants to make the cache grow unbounded. Under sustained load, this can exhaust the Node.js heap and crash the process.
### Patches
Update to `@fastify/accepts-serializer >= 6.0.4`. The cache is now bounded by an LRU with a default size of 100 entries, configurable via the new `cacheSize` plugin option.
### Workarounds
None. Upgrade is required.
References
External links from the advisory. They lead to third-party sites.