Read the docs
TI-2026-01216 Aliases CVE-2026-1526GHSA-vrm6-8vpv-qv8q

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Priority MEDIUM 41CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 14 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01279 70th percentileScored 2026-11-07
Fix Partial undici (undici): 6.24.0: 7.24.0undici (npm): 6.24.0, 7.24.0Red Hat: 17 advisoriesRed Hat: 14 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSundici< 6.24.0; 7.0.0 < 7.24.06.24.0: 7.24.0Patch availableCNA
—undici (npm)before 6.24.06.24.0Patch availableGHSA-vrm6-8vpv-qv8q
—undici (npm)7.0.0 to before 7.24.07.24.0Patch availableGHSA-vrm6-8vpv-qv8q
  • undici VendorNodeJS Affected < 6.24.0; 7.0.0 < 7.24.0 Fixed in 6.24.0: 7.24.0 Patch available CNA
  • undici (npm) Vendor— Affected before 6.24.0 Fixed in 6.24.0 Patch available GHSA-vrm6-8vpv-qv8q
  • undici (npm) Vendor— Affected 7.0.0 to before 7.24.0 Fixed in 7.24.0 Patch available GHSA-vrm6-8vpv-qv8q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*before 6.24.0; 7.0.0 to before 7.24.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions before 6.24.0; 7.0.0 to before 7.24.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA undici (undici) Fixed in 6.24.0: 7.24.0
  • Fix · GHSA-vrm6-8vpv-qv8q undici (npm) Fixed in 6.24.0 Advisory →
  • Fix · GHSA-vrm6-8vpv-qv8q undici (npm) Fixed in 7.24.0 Advisory →

Red Hat 17 advisories

  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:56431 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:34342 Released 2026-07-01 · Red Hat rating Critical
    Cluster Observability Operator 1.5.0
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
Show 14 more Red Hat advisories
  • RHSA-2026:21931 Released 2026-05-29 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.5
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9
  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:7983 Released 2026-04-14 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.s390x::nodejs:22 +28
  • RHSA-2026:7670 Released 2026-04-13 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.s390x::nodejs:24 +25
  • RHSA-2026:7675 Released 2026-04-13 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.14.1-2.el10_1, nodejs24-devel-1:24.14.1-2.el10_1, nodejs24-docs-1:24.14.1-2.el10_1 +3
  • RHSA-2026:7350 Released 2026-04-09 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.s390x::nodejs:24 +25
  • RHSA-2026:7310 Released 2026-04-09 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.22.2-2.el10_0, nodejs-devel-1:22.22.2-2.el10_0, nodejs-docs-1:22.22.2-2.el10_0 +4
  • RHSA-2026:7302 Released 2026-04-09 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22 +28
  • RHSA-2026:7123 Released 2026-04-08 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22 +28
  • RHSA-2026:7080 Released 2026-04-08 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.22.2-1.el10_1, nodejs-devel-1:22.22.2-1.el10_1, nodejs-docs-1:22.22.2-1.el10_1 +4
  • RHSA-2026:5807 Released 2026-03-25 · Red Hat rating Important
    RHOAI 2.16.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:34342
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:7080, RHSA-2026:7675
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:7123, RHSA-2026:7670
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:7302, RHSA-2026:7350
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:7310
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:7983
Red Hat OpenShift AI 2.16Fixed RHSA-2026:5807
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Red Hat OpenShift Pipelines 1.20Fixed RHSA-2026:21931
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:56431
Not affected: 13 products
  • Cluster Observability Operator 1.5
  • Cryostat 4 on RHEL 9
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.16
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat OpenShift Pipelines 1.20
  • Red Hat Openshift Data Foundation 4.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1526
  2. 2026-10-03 Alias added: GHSA-vrm6-8vpv-qv8q
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-10 Fix available: Red Hat OpenShift Pipelines 1.20 · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat
  6. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Advisory 3

Other 4

  • TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
  • TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
  • TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
  • TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
  • TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
  • TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences