Denial-of-Service Vulnerability in Undici WebSocket Client by Node.js

CVE-2026-1526

What is CVE-2026-1526?

The Undici WebSocket client contains a vulnerability that allows for denial-of-service attacks due to unbounded memory consumption during the permessage-deflate decompression process. When the WebSocket client negotiates the permessage-deflate extension, it decompresses incoming compressed data without a limit on the size of the decompressed output. This presents a risk if a malicious WebSocket server sends a small compressed payload that expands significantly during decompression, leading to substantial memory usage. Consequently, this can exhaust the Node.js process’s memory, resulting in crashes or unresponsiveness. The vulnerability specifically resides in the PerMessageDeflate.decompress() method, which fails to enforce safe thresholds for the total size of decompressed data.

References