HIGH 7.5

GHSA-f269-vfmq-vjvj

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Details

### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

### Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

### Workarounds

There are no workarounds.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / undici

Introduced in: 6.0.0 Fixed in: 6.24.0

Fix npm install undici@6.24.0

npm / undici

Introduced in: 7.0.0 Fixed in: 7.24.0

Fix npm install undici@7.24.0

References

https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj [WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-1528 [ADVISORY]
https://hackerone.com/reports/3537648 [WEB]
https://cna.openjsf.org/security-advisories.html [WEB]
https://github.com/nodejs/undici [PACKAGE]