PT-2026-25075 · Undici+1 · Undici+1

Matteo Collina + 1 · CVE-2026-1528 · Published 2026-03-12 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions undici versions prior to 7.24.0 undici versions prior to 6.24.0

Description A server can respond with a WebSocket frame utilizing the 64-bit length format and an excessively large length value. The ByteParser component within undici experiences an integer overflow during internal mathematical operations, leading to an invalid state and ultimately causing a fatal TypeError that terminates the process.

Recommendations Upgrade to undici version 7.24.0 or later. Upgrade to undici version 6.24.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-1284

CWE-248

Related Identifiers

ALSA-2026:7080

ALSA-2026:7123

ALSA-2026:7350

ALSA-2026:7670

ALSA-2026:7675

CLEANSTART-2026-CE10526

CLEANSTART-2026-DV49099

CLEANSTART-2026-GS57401

CLEANSTART-2026-NB51079

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CVE-2026-1528

GHSA-F269-VFMQ-VJVJ

RHSA-2026:7080

RHSA-2026:7123

RHSA-2026:7302

RHSA-2026:7310

RHSA-2026:7350

RHSA-2026:7670

RHSA-2026:7675

RHSA-2026:7983

Affected Products

Rocky Linux

Undici

References · 226

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1528.json · Exploit
• https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1528 · Vendor Advisory
• https://cna.openjsf.org/security-advisories.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:7080 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:7350 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:7123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-7670.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:7080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2581 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27601 · Security Note
• https://errata.rockylinux.org/RLSA-2026:7302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24842 · Security Note