PkgSeer

Vulnerability GHSA-vxpw-j846-p89q

High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
June 19, 2026 at 02:22 PM UTC
undici WebSocket client vulnerable to denial of service via fragment count bypass
0.1.0 - 6.26.0 and 7.0.0 - 7.27.2 and 8.0.0 - 8.4.1
0.1.0 - 6.26.0 and 7.0.0 - 7.27.2 and 8.0.0 - 8.4.1

Summary

undici WebSocket client vulnerable to denial of service via fragment count bypass

Details

Impact

The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

All releases starting at undici 6.17.0 are affected.

Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

Workarounds

No workaround is available. The fix must be applied through an upgrade.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk
7 days ago
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-4w7w-5xrc-9h26
7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-4w7w-5xrc-9h26
High Risk
7 days ago
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
4.0.0 - 6.29.0 and 7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-2m5v-pch6-74hx
4.0.0 - 6.29.0 and 7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-2m5v-pch6-74hx
High Risk
7 days ago
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
4.2.1 - 6.29.0 and 7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-qrxm-fqhp-jwvm
4.2.1 - 6.29.0 and 7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-qrxm-fqhp-jwvm
Medium Risk
7 days ago
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
5.15.0 - 6.29.0 and 7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-9fm3-97px-rjf6
5.15.0 - 6.29.0 and 7.0.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-9fm3-97px-rjf6
Medium Risk
7 days ago
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
7.15.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-55wc-3pg8-jfw6
7.15.0 - 7.30.0 and 8.0.0 - 8.12.1 GHSA-55wc-3pg8-jfw6
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
4 months ago
June 19, 2026 at 02:22 PM UTC
Fixed (8.5.0)
4 months ago
June 15, 2026 at 03:50 PM UTC
Fixed (7.28.0)
4 months ago
June 15, 2026 at 03:51 PM UTC
Fixed (6.27.0)
4 months ago
June 15, 2026 at 03:51 PM UTC
Last Modified
6 hours ago
November 04, 2026 at 03:45 AM UTC