CVE-2026-1528
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
| CWE | CWE-248 CWE-1284 |
| Vendor | undici |
| Product | undici |
| Published | Mar 12, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for undici undici
Be the first to know when new high vulnerabilities affecting undici undici are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
undici / undici
>= 6.0.0 < 6.24.0; 7.0.0 < 7.24.0
References
github.com: https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj hackerone.com: https://hackerone.com/reports/3537648 cna.openjsf.org: https://cna.openjsf.org/security-advisories.html access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-1528 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2447145 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1528.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17789 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7310 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7080 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7675 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7123 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7670 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7983 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7302 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7350 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34342 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9742 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13826 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5807 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21772 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21931
Credits
Matteo Collina Ulises Gascón