What’s Vulnerable › Vulnerabilities

CVE-2026-1528: undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-12 · updated 2026-09-04
• Weakness: CWE-248

Description

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Affected products

• undici: before 6.24.0; from 7.0.0 before 7.24.0 — fixed in 6.24.0, 7.24.0

How to fix

Upgrade to a fixed version: undici 6.24.0, 7.24.0. Check the vendor advisory for mitigations.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
• https://hackerone.com/reports/3537648
• https://access.redhat.com/errata/RHSA-2026:13826
• https://access.redhat.com/errata/RHSA-2026:17789
• https://access.redhat.com/errata/RHSA-2026:21772
• https://access.redhat.com/errata/RHSA-2026:21931
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:5807
• https://access.redhat.com/errata/RHSA-2026:7080
• https://access.redhat.com/errata/RHSA-2026:7123
• https://access.redhat.com/errata/RHSA-2026:7302

Get alerted when CVE-2026-1528 or the next vulnerability affects your stack