CVE-2026-1528

EUVD-2026-11703
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
Affected Products (NVD)
VendorProductVersion
nodejsundici
𝑥
< 6.24.0
nodejsundici
7.0.0 ≤
𝑥
< 7.24.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-undici
jammy
dne
noble
needs-triage
questing
needs-triage
resolute
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
nodejs20
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-debuginfo
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-debugsource
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-devel
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-docs
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-full-i18n
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-libs
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-libs-debuginfo
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.3
fixed
nodejs20-npm
Amazon Linux 2023
1:10.8.2-1.20.20.1.1.amzn2023.0.3
fixed
nodejs22
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-debuginfo
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-debugsource
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-devel
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-docs
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-full-i18n
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-libs
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-libs-debuginfo
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.2
fixed
nodejs22-npm
Amazon Linux 2023
1:10.9.4-1.22.22.1.1.amzn2023.0.2
fixed
nodejs24
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-debuginfo
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-debugsource
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-devel
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-docs
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-full-i18n
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-libs
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-libs-debuginfo
Amazon Linux 2023
1:24.14.0-1.amzn2023.0.2
fixed
nodejs24-npm
Amazon Linux 2023
1:11.9.0-1.24.14.0.1.amzn2023.0.2
fixed
v8-11.3-devel
Amazon Linux 2023
3:11.3.244.8-1.20.20.1.1.amzn2023.0.3
fixed
v8-12.4-devel
Amazon Linux 2023
3:12.4.254.21-1.22.22.1.1.amzn2023.0.2
fixed
v8-13.6-devel
Amazon Linux 2023
3:13.6.233.17-1.24.14.0.1.amzn2023.0.2
fixed
Common Weakness Enumeration
References
https://cna.openjsf.org/security-advisories.html
https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
https://hackerone.com/reports/3537648