CVE-2026-1526: Undici WebSocket Client Suffers from Unbounded Memory Consumption Vulnerability
Summary
CVE-2026-1526: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression. Affects undici across 2 version ranges.
< 6.24.0
>= 7.0.0, < 7.24.0
Fixed in 6.24.0 or 7.24.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is a popular HTTP/1.1 client designed for Node.js, known for its performance and efficiency. It provides a lightweight and modern API for making HTTP requests and is often used in applications that require high throughput. However, the undici WebSocket client has a critical vulnerability that can lead to denial-of-service attacks, specifically during the decompression of frames negotiated with the permessage-deflate extension.
Vulnerability Detail
The vulnerability arises from the PerMessageDeflate.decompress() method in the undici WebSocket client, which decompresses incoming compressed frames without enforcing a limit on the size of the decompressed data. This allows a malicious WebSocket server to send a small compressed frame, known as a 'decompression bomb,' that expands to an excessively large size in memory. As a result, the Node.js process can exhaust available memory, leading to crashes or unresponsiveness. The impact includes remote denial of service against any Node.js application using undici's WebSocket client, with a single compressed frame of approximately 6 MB potentially decompressing to over 1 GB, bypassing V8 heap limits and rendering application-level mitigations ineffective.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.24.06.24.0npm install undici@6.24.0 -
>= 7.0.0, < 7.24.07.24.0npm install undici@7.24.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workarounds are available for this vulnerability, as the decompression occurs before message delivery, making it impossible to mitigate at the application level.
Conclusion
In summary, the undici WebSocket client is vulnerable to a denial-of-service attack due to unbounded memory consumption during permessage-deflate decompression. Users are strongly advised to upgrade to the patched versions to mitigate this risk.
See every vulnerability recorded for undici →
FAQ
The vulnerability allows for unbounded memory consumption during the decompression of WebSocket frames, leading to potential denial-of-service attacks.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The consequences include potential crashes or unresponsiveness of Node.js applications using the undici WebSocket client due to memory exhaustion.
Unfortunately, there are no effective workarounds available for this vulnerability, as it requires an upgrade to the patched versions.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for undici.
