Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. ### Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ### Workarounds There are no workarounds.
02 / AFFECTED SOFTWARE
Affected packages
219 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. ### Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ### Workarounds There are no workarounds.
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
05 / REFERENCES
Further evidence
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
- https://hackerone.com/reports/3537648
- https://nvd.nist.gov/vuln/detail/CVE-2026-1528
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:17789
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/errata/RHSA-2026:21931
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:5807
- https://access.redhat.com/errata/RHSA-2026:7080
- https://access.redhat.com/errata/RHSA-2026:7123
- https://access.redhat.com/errata/RHSA-2026:7302
- https://access.redhat.com/errata/RHSA-2026:7310
- https://access.redhat.com/errata/RHSA-2026:7350
- https://access.redhat.com/errata/RHSA-2026:7670
- https://access.redhat.com/errata/RHSA-2026:7675
- https://access.redhat.com/errata/RHSA-2026:7983
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-1528
- https://bugzilla.redhat.com/show_bug.cgi?id=2447145
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1528.json
- https://github.com/nodejs/undici/
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1528.json