Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the Node.js heap and crashing the process. Versions <= 6.0.3 are affected. Update to 6.0.4 or later, which bounds the cache via an LRU with a default size of 100 entries, configurable through the new cacheSize plugin option.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-04 | 3 | General2Patch1 |
| 2026-05-05 | 1 | General1 |
| 2026-05-08 | 1 | Disclosure1 |
| 2026-05-25 | 1 | Patch1 |
#CVSS 7.5 HIGH: CVE-2026-7768 in @fastify/accepts-serializer <=6[.]0[.]3 allows remote attackers to crash Node.js via unbounded cache exhaustion. Update to 6[.]0[.]4+ immediately. #CVE #PatchNow https://t.co/rS12c9W7dY
Post summary
The tweet highlights a CVE-2026-7768 in Fastify's accepts-serializer, explains a CVSS 7.5 high remote DDoS via cache exhaustion, and urges users to patch to version 6.0.4 or later.
🔴 (Fastify), Denial of Service, #CVE-2026-7768 (High) https://dailycve.com/fastify-denial-of-service-cve-2026-7768-high/
Post summary
A high‑severity denial‑of‑service vulnerability (CVE‑2026‑7768) has been disclosed for Fastify, but no PoC, exploit, patch, or active exploitation is mentioned.
CVE-2026-7768 Denial of Service via Unbounded Cache in @fastify/accepts-serializ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7768 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post alerts about a DoS vulnerability (unbounded cache) in the fastify/accepts-serializ package, with no reference to a PoC, exploit, patch, or active exploitation.
🚨*CVE* CVE-2026-7768 @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated cli… https://www.cve.org/CVERecord?id=CVE-2026-7768 ----- Traducción: CVE-2026-7768 @fa… http://infoflow.cloud`
Post summary
The post references CVE-2026-7768 and supplies technical details about the vulnerability, but provides no PoC, exploit tool, evidence of active exploitation, patch, or debunking claim.
CVE-2026-7768 @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated cli… https://www.cve.org/CVERecord?id=CVE-2026-7768
Post summary
The post outlines a technical flaw in fastify/accepts-serializer where unbounded caching of serializer results could lead to resource exhaustion, but no PoC, exploit, patch, or exploitation evidence is provided.
🚨 High-severity security fix in @fastify/accepts-serializer@6.0.4 just released! Patches CVE-2026-7768 — vulnerable to Denial of Service via Unbounded Accept Header Cache Growth https://github.com/fastify/fastify-accepts-serializer/security/advisories/GHSA-qxhc-wx3p-2wmg
Post summary
The post announces a high‑severity patch for CVE‑2026‑7768, detailing a denial‑of‑service flaw caused by unbounded Accept Header cache growth.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify\/accepts-serializer | - | node.js | - |