Fastify’s Web Streams response handling allows a remote client to exhaust process memory. A request that streams data slowly or that does not read the response triggers unbounded buffering because backpressure is ignored, leading to crashes or severe degradation. The vulnerability is an example of uncontrolled resource consumption (CWE-770) and results in a denial‑of‑service scenario where an attacker can force the application to run out of memory.

The Fastify web framework for Node.js is affected. Versions before 5.7.3 are vulnerable. Applications that return a ReadableStream (or a Response with a Web Stream body) via reply.send() are impacted.

The CVSS score is 3.7 (low), EPSS is under 1% and the vulnerability is not listed in the KEV catalog, indicating a low likelihood of exploitation. Nevertheless, the attack is remote, requires the ability to send a control‑flow request that streams data slowly or stops reading, and can lead to out‑of‑memory crashes or severe performance degradation. The risk remains low but could impact availability in a critical system if an attacker triggers the condition.