CVE-2026-25224

CVE-2026-25224 is a denial-of-service vulnerability in Fastify, a Node.js web framework, affecting versions prior to 5.7.3. It allows a remote client to exhaust server memory by exploiting unbounded buffering when applications return Web Streams via reply.send(), potentially leading to process crashes. The vulnerability has a CVSS score of 3.7 (Low) with a network attack vector and high attack complexity, resulting in a low impact on availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.