Denial of Service (CWE-400)CVSS 3.7€0
DoS via Unbounded Memory Allocation in sendWebStream on Fastify v5.7.0+ leads to OOM crash when backpressure is ignored
onlybugs05
Disclosed on HackerOne · March 5, 2026
Publicly disclosed report · by onlybugs05
View original on HackerOneDenial of Service (DoS) via Unbounded Memory Allocation in sendWebStream (Backpressure Ignored)
Weakness
CWE-770: Allocation of Resources Without Limits or Throttling
Severity
High (7.5)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Attack Vector: Network
- Attack Complexity: Low