CVE-2026-1528
EUVD-2026-1170312.03.2026, 21:16
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| nodejs | undici | 𝑥 < 6.24.0 |
| nodejs | undici | 7.0.0 ≤ 𝑥 < 7.24.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-9 ≤ 𝑥 < * | ADP |
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10 | 1:22.22.2-1.el10_1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10 | 1:24.14.1-2.el10_1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 1:22.22.2-2.el10_0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 8100020260331102257.6d880403 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 8100020260408131901.6d880403 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 9070020260401095228.rhel9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 9070020260402152654.rhel9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 9060020260409121057.rhel9 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839279 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782840539 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839996 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1776784286 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1777903262 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.16 | 1774282136 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1779814592 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Pipelines 1.2 | 1779910201 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| nodejs20 |
| ||
| nodejs20-debuginfo |
| ||
| nodejs20-debugsource |
| ||
| nodejs20-devel |
| ||
| nodejs20-docs |
| ||
| nodejs20-full-i18n |
| ||
| nodejs20-libs |
| ||
| nodejs20-libs-debuginfo |
| ||
| nodejs20-npm |
| ||
| nodejs22 |
| ||
| nodejs22-debuginfo |
| ||
| nodejs22-debugsource |
| ||
| nodejs22-devel |
| ||
| nodejs22-docs |
| ||
| nodejs22-full-i18n |
| ||
| nodejs22-libs |
| ||
| nodejs22-libs-debuginfo |
| ||
| nodejs22-npm |
| ||
| nodejs24 |
| ||
| nodejs24-debuginfo |
| ||
| nodejs24-debugsource |
| ||
| nodejs24-devel |
| ||
| nodejs24-docs |
| ||
| nodejs24-full-i18n |
| ||
| nodejs24-libs |
| ||
| nodejs24-libs-debuginfo |
| ||
| nodejs24-npm |
| ||
| v8-11.3-devel |
| ||
| v8-12.4-devel |
| ||
| v8-13.6-devel |
|
Common Weakness Enumeration
References