PT-2026-50470 · Undici · Undici

Lzhou1110 + 5 · Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-9675

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions undici version 8.1.0

Description The undici WebSocket client enforces maxPayloadSize on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the new WebSocket(...) client that connect to compromised or attacker-controlled endpoints.

Recommendations Upgrade to undici versions 8.5.0 or later.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-9675

Affected Products

Undici

References · 5

• https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq · Note
• https://twitter.com/kom_256/status/2067282283933938150 · Twitter Post
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/CVEnew/status/2067351031609012520 · Twitter Post
• https://twitter.com/infoflowcloud/status/2067352057674105290 · Twitter Post