Live › vulnerability › CVE-2026-9675
Go to dashboardThe undici WebSocket client does not cap the total size of fragmented messages, only each fragment, so a malicious WebSocket server can stream many small fragments until the client process runs out of memory. The result is a denial of service against the client process, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| undici | npm | >= 8.0.0, < 8.5.0 | 8.5.0 |
| nodejs undici | vendor | >= 8.0.0, < 8.5.0 | 8.5.0 |
Run npm ls undici in the project and check whether any resolved version is >= 8.0.0 and < 8.5.0.
Look for direct or transitive use of new WebSocket(...) from undici that connects to endpoints you do not control.
Upgrade undici to 8.5.0 or later; no workaround is available per the advisory.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.
Upgrade to undici >= 8.5.0.
No workaround is available. The fix must be applied through an upgrade.
This page as .md · .json · in your agent: get_signal("CVE-2026-9675")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.