PT-2026-50470 · Npm · Undici

Lzhou1110 + 5 · CVE-2026-9675 · Published 2026-06-17 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions undici version 8.1.0

Description The undici WebSocket client enforces maxPayloadSize on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the new WebSocket(...) client that connect to compromised or attacker-controlled endpoints.

Recommendations Upgrade to undici versions 8.5.0 or later.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-9675

GHSA-38RV-X7PX-6HHQ

RHSA-2026:22934

RHSA-2026:25561

RHSA-2026:7378

Affected Products

Undici

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9675.json · Exploit
• https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38rv-x7px-6hhq · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-9675 · Vendor Advisory
• https://cna.openjsf.org/security-advisories.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9675 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-9675 · Security Note
• https://osv.dev/vulnerability/CVE-2026-9675 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-9675 · Vendor Advisory
• https://github.com/nodejs/undici · Note
• https://twitter.com/matteocollina/status/2067639484334674085 · Twitter Post
• https://t.me/CVEtracker/57135 · Telegram Post
• https://twitter.com/CVEnew/status/2067351031609012520 · Twitter Post
• https://t.me/cveNotify/170019 · Telegram Post
• https://twitter.com/infoflowcloud/status/2067352057674105290 · Twitter Post