FlawAtlas
Search the atlas
CVE-2026-1528 High

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. ### Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ### Workarounds There are no workarounds.

Exploit probability 0.5%
Published March 13, 2026
Required by Not available
Last source change March 18, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

219 explicit affected versions

npm undici

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities GHSA-f269-vfmq-vjvj

### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. ### Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ### Workarounds There are no workarounds.

View original source
Open Source Vulnerabilities CVE-2026-1528

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

View original source

05 / REFERENCES

Further evidence