GHSA-f269-vfmq-vjvj (CVE-2026-1528)

Details

Impact

A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

There are no workarounds.

Affected Packages

undici

npm

Fixed in:

6.24.0

undici

npm

Fixed in:

7.24.0

References

WEB

https://cna.openjsf.org/security-advisories.html

ADVISORY

https://github.com/advisories/GHSA-f269-vfmq-vjvj

PACKAGE

https://github.com/nodejs/undici

WEB

https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj

WEB

https://hackerone.com/reports/3537648

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2026-1528