CVE-2026-1528: Undici WebSocket 64-bit Length Overflow Vulnerability
Summary
CVE-2026-1528: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client. Affects undici across 2 version ranges.
>= 6.0.0, < 6.24.0
>= 7.0.0, < 7.24.0
Fixed in 6.24.0 or 7.24.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is a popular HTTP/1.1 client designed for Node.js, known for its performance and efficiency in handling HTTP requests. It provides a simple API for making requests and managing connections, making it a go-to choice for developers. However, it has a vulnerability that arises when handling WebSocket frames with excessively large 64-bit lengths, which can lead to application crashes.
Vulnerability Detail
The vulnerability occurs when a server sends a WebSocket frame using the 64-bit length format with an extremely large length. This causes the ByteParser in Undici to overflow during internal calculations, resulting in an invalid state. Consequently, a fatal TypeError is thrown, which terminates the process unexpectedly. This can lead to denial of service, affecting the availability of applications relying on Undici for WebSocket communication.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.24.06.24.0npm install undici@6.24.0 -
>= 7.0.0, < 7.24.07.24.0npm install undici@7.24.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no workarounds available for this vulnerability. The only solution is to upgrade to the patched versions.
Conclusion
In summary, the CVE-2026-1528 vulnerability in Undici poses a significant risk due to its potential to crash applications using WebSocket communication. It is crucial for users to upgrade to the patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for undici →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The affected versions are from 6.0.0 to 6.24.0 and from 7.0.0 to 7.24.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If left unaddressed, this vulnerability can lead to application crashes, resulting in denial of service and impacting the availability of your services.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing the package-lock.json file.
Related vulnerabilities
Recent vulnerabilities recorded for undici.
