PT-2026-25065 · Undici+1 · Undici+1

Matteo Collina + 1 · Publicado 2026-03-12 · Atualizado 2026-06-04 · CVE-2026-1526

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions undici versions prior to 7.24.0

Description The undici WebSocket client is susceptible to a denial-of-service condition due to unrestricted memory usage during permessage-deflate decompression. When a WebSocket connection utilizes the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limits on the decompressed data size. A malicious WebSocket server can transmit a small compressed frame, known as a "decompression bomb," which expands to a substantial size in memory. This can lead to the Node.js process exhausting available memory, resulting in a crash or unresponsiveness. The issue resides within the PerMessageDeflate.decompress() method, which accumulates decompressed data in memory without verifying if the total size exceeds a safe limit.

Recommendations Upgrade to version 7.24.0 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-409

Identificadores relacionados

ALSA-2026:7080

ALSA-2026:7123

ALSA-2026:7350

ALSA-2026:7670

ALSA-2026:7675

CLEANSTART-2026-CE10526

CLEANSTART-2026-DV49099

CLEANSTART-2026-GS57401

CLEANSTART-2026-NB51079

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CVE-2026-1526

GHSA-VRM6-8VPV-QV8Q

RHSA-2026:7080

RHSA-2026:7123

RHSA-2026:7302

RHSA-2026:7310

RHSA-2026:7350

RHSA-2026:7670

RHSA-2026:7675

RHSA-2026:7983

Produtos afetados

Rocky Linux

Undici

Referências · 213

• https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q · Aviso do Fabricante
• https://github.com/nodejs/undici · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CE10526.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GS57401.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NB51079.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DV49099.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SW34937.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OW14933.json · Nota
• https://access.redhat.com/security/cve/CVE-2026-1525 · Nota
• https://osv.dev/vulnerability/CVE-2026-25128 · Nota
• https://errata.almalinux.org/8/ALSA-2026-7123.html · Aviso do Fabricante
• https://osv.dev/vulnerability/ghsa-5j98-mcp5-4vw2 · Nota
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-1526 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-27904 · Nota
• https://errata.almalinux.org/10/ALSA-2026-7080.html · Aviso do Fabricante