CVE-2026-25224: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25224 is a Denial of Service vulnerability in the Fastify Node.js web framework caused by unbounded memory allocation in its sendWebStream function. It affects all Fastify versions up to and including 5.7.2 (npm package). The vulnerability was published on February 2, 2026, and patched in version 5.7.3. It carries a CVSS v3.1 base score of 3.7 (Low) (Github Advisory, Fastify Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In the vulnerable sendWebStream function within lib/reply.js, when a route handler returns a ReadableStream or a Response with a Web Stream body via reply.send(), the framework continuously reads from the stream and writes to the HTTP response socket without checking the return value of res.write(). When a slow or non-reading client causes the socket's write buffer to fill up, res.write() returns false to signal backpressure — but the original code ignored this signal and continued reading and buffering stream chunks without bound, leading to unbounded heap growth. The fix (commit eb11156) adds a waitingDrain flag and a drain event listener so that further reads are paused until the socket is ready to accept more data (Fastify Advisory, Patch Commit).

Successful exploitation causes unbounded heap memory growth in the Node.js process, which can lead to process crashes via out-of-memory (OOM) errors or severe performance degradation affecting all users of the service. Only the availability of the affected server is impacted — there is no confidentiality or integrity impact. The vulnerability is scoped to the affected Fastify process and does not enable lateral movement or data exfiltration (Github Advisory, Red Hat Bugzilla).

No public exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.02% (6th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity — specifically, the attacker must be able to act as a slow or non-reading HTTP client against an endpoint that streams a Web Stream response, which limits opportunistic exploitation (Github Advisory).

1. Reconnaissance: Identify a Fastify-based application (version ≤ 5.7.2) that exposes an HTTP endpoint returning a ReadableStream or Response with a Web Stream body via reply.send().
2. Establish a slow connection: Open an HTTP connection to the target endpoint using a tool or custom script that deliberately reads the response body very slowly or not at all (e.g., using curl with rate limiting, or a custom socket client that opens the connection but never reads from it).
3. Trigger unbounded buffering: Because the client is not consuming data, the TCP socket's send buffer fills up and res.write() returns false. The vulnerable Fastify code ignores this backpressure signal and continues reading from the stream, buffering all chunks in memory.
4. Exhaust server memory: Maintain the slow/non-reading connection(s) while the server's stream source continues producing data. Heap memory grows without bound until the Node.js process crashes with an OOM error or becomes severely degraded, denying service to legitimate users (Fastify Advisory, Patch Commit).

• Process: Rapidly increasing Node.js heap memory usage (observable via process.memoryUsage(), APM tools, or OS-level monitoring) on a Fastify server serving Web Stream responses; eventual OOM crash of the Node.js process.
• Logs: Node.js process crash logs or system OOM killer logs (e.g., dmesg entries referencing the Node.js PID being killed); application logs showing abrupt termination without a handled exception.
• Network: Persistent, long-lived HTTP connections to streaming endpoints that transfer little or no data to the client side; unusually high number of open connections with low throughput on stream-serving routes.

The issue is fixed in Fastify version 5.7.3; all users should upgrade immediately. As a temporary workaround for those unable to upgrade, avoid returning Web Streams (ReadableStream or Response with a Web Stream body) from Fastify route handlers — use Node.js stream.Readable streams or buffered payloads instead, which are not affected by this issue. IBM API Connect users should refer to the IBM advisories for product-specific patch guidance (Fastify Advisory, IBM Advisory 1, IBM Advisory 2).

The vulnerability was discovered by security researcher onlybugs05 via HackerOne (report #3524779) and remediated by Fastify maintainer mcollina. Red Hat tracked the issue via Bugzilla and assessed it as low severity. IBM subsequently issued advisories for affected IBM API Connect products. No significant broader media coverage or notable community controversy has been observed (Fastify Advisory, Red Hat Bugzilla).