GHSA-vxpw-j846-p89q
undici WebSocket client vulnerable to denial of service via fragment count bypass
Quick fix
GHSA-vxpw-j846-p89q — undici: upgrade to the fixed version with the command below.
npm install undici@6.27.0Details
## Impact
The undici WebSocket client enforces `maxPayloadSize` on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (`new WebSocket(...)`) or the `WebSocketStream` API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
## Patches
Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.
## Workarounds
No workaround is available. The fix must be applied through an upgrade.
Are you affected?
Enter the version of the package you're using.