CVE-2026-1528

HIGH7.5

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

Published Mar 12, 2026

Modified Today

Details

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

References

WEB

https://cna.openjsf.org/security-advisories.html

WEB

https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj

WEB

https://hackerone.com/reports/3537648

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-1528

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

Other

CWE-1284

CWE-248

Ecosystems

Timeline

PublishedMar 12, 2026

ModifiedMar 12, 2026