High · published June 17, 2026
Impact:
The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds:
No workaround is available. The fix must be applied through an upgrade.
| Product | Versions | Fixed in |
|---|---|---|
| nodejs/undici | ≥ 6.17.0, < 6.27.0 | 6.27.0 |
| nodejs/undici | ≥ 7.0.0, < 7.28.0 | 7.28.0 |
| nodejs/undici | ≥ 8.0.0, < 8.5.0 | 8.5.0 |