WebSocket Frame Processing Vulnerability in Undici by Node.js
CVE-2026-1528

7.5HIGH

Key Information:

Vendor

Undici

Status
Undici
Vendor
CVE Published:
12 March 2026

What is CVE-2026-1528?

A vulnerability has been identified in Undici affecting the handling of WebSocket frames. When a server responds with a WebSocket frame that utilizes the 64-bit length form with an unusually large size, the ByteParser within Undici overflows its internal calculations. This overflow can lead to an invalid state in the application, culminating in a fatal TypeError that causes the process to terminate unexpectedly. It is crucial for users to upgrade to Undici version v7.24.0 or v6.24.0 and later to mitigate this issue.

Affected Version(s)

undici >= 6.0.0 < 6.24.0; 7.0.0 < 7.24.0 < 6.0.0 6.24.0; 7.0.0 < 7.24.0

undici 6.24.0: 7.24.0

References

https://github.com/nodejs/undici/security/advisories/GHSA...
https://hackerone.com/reports/3537648
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matteo Collina
Ulises GascĂłn
.