Memory Exhaustion Vulnerability in undici HTTP Client Library

CVE-2026-109932

What is CVE-2026-109932?

The undici HTTP client library for Node.js suffers from a memory exhaustion vulnerability due to improper handling of PING and PONG WebSocket frames. Specifically, when an attacker sends small PING frames, the client fails to manage the outbound write queue effectively, resulting in uncontrolled memory growth and potential process termination. This flaw exists in several versions of undici and requires remedial action via upgrading to fixed versions, as there is no bypass available to mitigate the underlying issue.

References