CVE-2026-1528

EUVD-2026-11703
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
nodejsundici
𝑥
< 6.24.0
nodejsundici
7.0.0 ≤
𝑥
< 7.24.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-undici
jammy
dne
noble
needs-triage
questing
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://cna.openjsf.org/security-advisories.html
https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
https://hackerone.com/reports/3537648