🎯 New Report #3524779: DoS via Unbounded Memory Allocation in sendWebStream on Fastify v5.7.0 leads to OOM crash when backpressure is ignored
🔺Severity: null
👽 Reporter: onlybugs05
⭐️ Reputation: 140
🛠 State: resolved
💼 Team: Fastify
💵 Bounty: null
🕐 Submitted: 2026-01-26
⏰ Disclosed: 2026-03-05 15:49:48
📝 Summary: A vulnerability was discovered in Fastify versions 5.7.0 and later. The issue was in the "sendWebStream" function, which failed to handle TCP backpressure correctly. When a ReadableStream was sent as a response, Fastify continuously pulled data from the stream producer and wrote it to the response object, ignoring the return value of the write operation. This allowed a fast producer to fill the server's memory indefinitely, leading to an Out-Of-Memory (OOM) crash if a client stopped reading the response.
📂 Report JSON File: 3524779
@hackeronereports