Memory Exhaustion Vulnerability in undici WebSocket Client Affects Node.js Applications

CVE-2026-9675

What is CVE-2026-9675?

The undici WebSocket client has a vulnerability that allows an attacker to exploit the maxPayloadSize enforcement per-frame. By sending multiple small fragments that each pass validation, an unauthorized WebSocket server can cause the cumulative size of these fragments to exceed the limit. This results in unbounded memory growth in the client process, leading to memory exhaustion and potential denial of service. Users of undici version 8.1.0 are particularly at risk but those on earlier versions or 8.5.0 and above are secure. Immediate action involves upgrading to a patched version to mitigate this risk.

References