Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

GHSA-f269-vfmq-vjvj · CVE-2026-1528

Published Mar 13, 2026 · Modified Sep 10, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

There are no workarounds.

References

WEB https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-1528
WEB https://hackerone.com/reports/3537648
WEB https://cna.openjsf.org/security-advisories.html
PACKAGE https://github.com/nodejs/undici

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes