{"id":"CVE-2026-9675","kind":"vulnerability","aliases":["CVE-2026-9675","GHSA-38rv-x7px-6hhq"],"related":[],"title":"undici WebSocket client vulnerable to denial of service via cumulative fragment bypass","description":"## Impact\n\nThe undici WebSocket client enforces `maxPayloadSize` per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (`new WebSocket(...)`) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nThis is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the `maxPayloadSize` feature and is also unaffected.\n\n## Patches\n\nUpgrade to undici >= 8.5.0.\n\n## Workarounds\n\nNo workaround is available. The fix must be applied through an upgrade.","summary":"The undici WebSocket client does not cap the total size of fragmented messages, only each fragment, so a malicious WebSocket server can stream many small fragments until the client process runs out of memory. The result is a denial of service against the client process, not code execution.","severity":"high","cvss":7.5,"epss":0.004879999905824661,"exploited":false,"exploited_at":null,"products":[{"name":"undici","fixed":["8.5.0"],"affected":">= 8.0.0, < 8.5.0","ecosystem":"npm"},{"name":"nodejs undici","fixed":["8.5.0"],"affected":">= 8.0.0, < 8.5.0","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-400","cwe-770","node.js","package","self-hosted","undici","websocket-client"],"not_affected_if":["no-untrusted-websocket-endpoints","undici-6.25.0-line","undici-7.x","undici-below-8.0.0"],"how_to_check":"Run `npm ls undici` in the project and check whether any resolved version is >= 8.0.0 and < 8.5.0.\nLook for direct or transitive use of `new WebSocket(...)` from undici that connects to endpoints you do not control.","fix":"Upgrade undici to 8.5.0 or later; no workaround is available per the advisory.","status":"open","published_at":"2026-06-17T17:17:28+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T21:45:40+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:45:40Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade undici to 8.5.0 or later; no workaround is available per the advisory.\nunknown","reach":"network","impact":"low","summary":"The undici WebSocket client does not cap the total size of fragmented messages, only each fragment, so a malicious WebSocket server can stream many small fragments until the client process runs out of memory. The result is a denial of service against the client process, not code execution.","category":"package","who_cares":["node.js","undici","websocket-client","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Malicious WebSocket server exhausts client process memory, causing denial of service.","analyst_note":"","how_to_check":"Run `npm ls undici` in the project and check whether any resolved version is >= 8.0.0 and < 8.5.0.\nLook for direct or transitive use of `new WebSocket(...)` from undici that connects to endpoints you do not control.\nunknown","needs_analyst":false,"not_affected_if":["undici-below-8.0.0","undici-7.x","undici-6.25.0-line","no-untrusted-websocket-endpoints"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":3072,"output_tokens":423,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-400':28B '-770':30B '-9675':15A,23A '38rv':18A '6.25.0':184C '6hhq':20A '7':198C '8.1.0':182C '8.5.0':214C 'affect':149C 'also':208C 'appli':224C 'applic':150C 'attack':169C 'attacker-control':168C 'avail':219C 'bypass':12A 'cap':46B 'caus':131C 'check':190C 'client':3A,39B,43B,68B,83B,92C,137C,157C 'code':86B 'collect':126C 'compromis':172C 'configur':129C 'connect':165C 'control':170C 'cumul':10A,103C,189C 'cve':13A,21A 'cwe':27B,29B 'denial':6A,78B,146C 'endpoint':174C 'enforc':93C,101C 'equival':188C 'exceed':127C 'execut':87B 'exhaust':143C 'featur':205C 'fix':221C 'fragment':11A,51B,55B,65B,106C,117C 'frame':97C,123C 'ghsa':17A 'ghsa-38rv-x7px-6hhq':16A 'growth':134C 'host':35B 'impact':88C 'induc':163C 'limit':130C 'line':185C,200C 'malici':58B,110C 'mani':63B,115C 'maxpayloads':94C,204C 'memori':73B,133C,142C 'messag':52B,108C 'must':222C 'never':201C 'new':158C 'node.js':31B 'nodejs':25A 'packag':32B 'pass':120C 'patch':210C 'per':96C,122C 'per-fram':95C,121C 'process':69B,84B,138C 'regress':178C 'result':75B,140C 'run':70B 'self':34B 'self-host':33B 'server':60B,112C 'servic':8A,80B,148C 'ship':186C 'size':49B,104C 'small':64B,116C 'specif':179C 'start':193C 'stream':62B,114C 'total':48B 'unaffect':196C,209C 'unbound':132C 'uncompress':107C 'undici':1A,24A,26A,36B,41B,90C,155C,181C,213C 'upgrad':211C,227C 'use':153C 'valid':124C 'via':9A 'vulner':4A 'websocket':2A,38B,42B,59B,91C,111C,156C,159C,173C 'websocket-cli':37B 'workaround':215C,217C 'x':199C 'x7px':19A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-17T17:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-38rv-x7px-6hhq","url":"https://github.com/advisories/GHSA-38rv-x7px-6hhq","severity":"high","published_at":"2026-06-18T14:28:10+00:00","modified_at":"2026-10-22T05:07:56+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9675","severity":null,"published_at":"2026-06-17T17:17:28+00:00","modified_at":"2026-06-25T17:46:52+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}