Live › vulnerability › CVE-2026-12151
The undici WebSocket client caps the total byte size of a message but not the number of fragments, so a malicious server can stream many tiny continuation frames. The client's memory grows without bound and the process can be exhausted into a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:41 UTC, 0h before NVD. All times on this page are UTC.
Applications that use the undici WebSocket client or WebSocketStream to connect to a WebSocket server that could be attacker-controlled or compromised. The sources say all releases from 6.17.0 onward are affected. No workaround is given, so the fix is an upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| undici | npm | < 6.27.0 | 6.27.0 |
| undici | npm | >= 7.0.0, < 7.28.0 | 7.28.0 |
| undici | npm | >= 8.0.0, < 8.5.0 | 8.5.0 |
| nodejs undici | vendor | >= 6.17.0, < 6.27.0 | 6.27.0 |
| nodejs undici | vendor | >= 7.0.0, < 7.28.0 | 7.28.0 |
| nodejs undici | vendor | >= 8.0.0, < 8.5.0 | 8.5.0 |
npm ls undici in the project and check whether any resolved version falls in the affected ranges below.new WebSocket(...) or WebSocketStream from undici to connect to endpoints it does not fully control.6.27.0 on the 6.x line.7.28.0 on the 7.x line.8.5.0 on the 8.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.
No workaround is available. The fix must be applied through an upgrade.
This page as .md · .json · in your agent: get_signal("CVE-2026-12151")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.