Every CVE Search/ Get API key

CVE-2026-9675

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

7.5 HighFix available

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches: Upgrade to undici >= 8.5.0.

Workarounds: No workaround is available. The fix must be applied through an upgrade.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.43%Up 0.1 points since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches: Upgrade to undici >= 8.5.0.

Workarounds: No workaround is available. The fix must be applied through an upgrade.

Record
CVE-2026-9675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-37752 7.5

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches: Upgrade to undici >= 8.5.0.

Workarounds: No workaround is available. The fix must be applied through an upgrade.

Record
EUVD-2026-37752
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-38rv-x7px-6hhq 7.5

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Impact

The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches

Upgrade to undici >= 8.5.0.

Workarounds

No workaround is available. The fix must be applied through an upgrade.

Record
GHSA-38rv-x7px-6hhq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
NVD 7.5

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches: Upgrade to undici >= 8.5.0.

Workarounds: No workaround is available. The fix must be applied through an upgrade.

Record
CVE-2026-9675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 7.5

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches: Upgrade to undici >= 8.5.0.

Workarounds: No workaround is available. The fix must be applied through an upgrade.

Record
CVE-2026-9675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVGHSA-38rv-x7px-6hhq 7.5

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Impact

The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches

Upgrade to undici >= 8.5.0.

Workarounds

No workaround is available. The fix must be applied through an upgrade.

Record
GHSA-38rv-x7px-6hhq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2026:22380 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:22380
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:22934 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:22934
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25561 5.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:25561
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7378 7.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7378
CVSS 3.0
7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-9675 7.5

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected. Patches: Upgrade to undici >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Record
UBUNTU-CVE-2026-9675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-9675 No score

CVE-2026-9675 in undici - Patched by Root

Root has patched CVE-2026-9675 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-9675
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 8.0.0 up to 8.5.0
8.5.0
nodejs26
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:11.16.0-1.26.3.0.1.2.hum1
0:11.16.0-1.26.3.0.1.2.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:26.3.0-1.2.hum1
0:26.3.0-1.2.hum1
cargo
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
Show 40 moreShow less
Affected packages
PackageAffectedFixed
clippy
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-analyzer
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-doc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-gdb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-lldb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-src
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
rustfmt
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.96.0-1.hum1
0:1.96.0-1.hum1
nodejs24
Red Hat:hummingbird:1
 before 0:24.16.0-1.hum1
0:24.16.0-1.hum1
nodejs24-bin
Red Hat:hummingbird:1
 before 0:24.16.0-1.hum1
0:24.16.0-1.hum1
nodejs24-devel
Red Hat:hummingbird:1
 before 0:24.16.0-1.hum1
0:24.16.0-1.hum1
nodejs24-docs
Red Hat:hummingbird:1
 before 0:24.16.0-1.hum1
0:24.16.0-1.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
 before 0:24.16.0-1.hum1
0:24.16.0-1.hum1
nodejs24-libs
Red Hat:hummingbird:1
 before 0:24.16.0-1.hum1
0:24.16.0-1.hum1
nodejs24-npm
Red Hat:hummingbird:1
 before 0:11.13.0-1.24.16.0.1.hum1
0:11.13.0-1.24.16.0.1.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
 before 0:24.16.0-1.hum1
0:24.16.0-1.hum1
nodejs25
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-docs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-full-i18n
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-libs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-npm
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:11.12.1-1.25.9.0.1.1.hum1
0:11.12.1-1.25.9.0.1.1.hum1
nodejs25-npm-bin
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
undici
Root:npm
 before 8.5.0-aikido.1
8.5.0-aikido.1
@rootio/undici
Root:npm
 before 8.5.0-root.io.1
8.5.0-root.io.1
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:25.10
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9675 is a high vulnerability (CVSS 7.5) in Nodejs Undici, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in undici 8.5.0.

References

Show 123 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open