Denial of service in fastify

published 2020-07-30 6 y ago modified 2026-06-17 4 mo ago also GHSA-xw5p-hw6r-2j98 , EUVD-2020-0654

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.

Patch / fix

fixed in 1 links 1

npm fastify 2.15.1

github.com/fastify/fastify@74c3157 commit

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

hackerone.com https://hackerone.com/reports/903521 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected packages

ecosystem	package	affected	fixed in
npm	fastify	<2.15.1	2.15.1

Affected products

n/a fastify

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

github.com /fastify/fastify/commit/74c3157ca90c3ffed9e4434f63c2017471ec970e
web
hackerone.com /reports/903521
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-8192
advisory

Sources

CVE List CVE-2020-8192
GitHub Advisory GHSA-xw5p-hw6r-2j98
NVD CVE-2020-8192

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary