VDB
KO
HIGH 7.5

GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

Details

## Impact

The undici WebSocket client enforces `maxPayloadSize` on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (`new WebSocket(...)`) or the `WebSocketStream` API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

All releases starting at undici 6.17.0 are affected.

## Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

## Workarounds

No workaround is available. The fix must be applied through an upgrade.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / undici
Introduced in: 0 Fixed in: 6.27.0
Fix npm install undici@6.27.0
npm / undici
Introduced in: 7.0.0 Fixed in: 7.28.0
Fix npm install undici@7.28.0
npm / undici
Introduced in: 8.0.0 Fixed in: 8.5.0
Fix npm install undici@8.5.0

References