Read the docs
TI-2026-08486 Aliases CVE-2026-9675GHSA-38rv-x7px-6hhq

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected. Patches: Upgrade to undici >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Partial undici (undici): 8.5.0undici (npm): 8.5.0Red Hat: 4 advisoriesRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSundici8.0.0 to before 8.5.08.5.0Patch availableCNA
—undici (npm)8.0.0 to before 8.5.08.5.0Patch availableGHSA-38rv-x7px-6hhq
  • undici VendorNodeJS Affected 8.0.0 to before 8.5.0 Fixed in 8.5.0 Patch available CNA
  • undici (npm) Vendor— Affected 8.0.0 to before 8.5.0 Fixed in 8.5.0 Patch available GHSA-38rv-x7px-6hhq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*8.0.0 to before 8.5.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions 8.0.0 to before 8.5.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA undici (undici) Fixed in 8.5.0
  • Fix · GHSA-38rv-x7px-6hhq undici (npm) Fixed in 8.5.0 Advisory →

Red Hat 4 advisories

  • RHSA-2026:25561 Released 2026-06-13 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs24-24.16.0-1.hum1@aarch64, nodejs24-24.16.0-1.hum1@src, nodejs24-24.16.0-1.hum1@x86_64 +14
  • RHSA-2026:22934 Released 2026-06-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cargo-1.96.0-1.hum1@aarch64, cargo-1.96.0-1.hum1@x86_64, clippy-1.96.0-1.hum1@aarch64 +32
  • RHSA-2026:22380 Released 2026-06-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs26-26.3.0-1.2.hum1@aarch64, nodejs26-26.3.0-1.2.hum1@src, nodejs26-26.3.0-1.2.hum1@x86_64 +14
Show 1 more Red Hat advisories
  • RHSA-2026:7378 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs25-25.9.0-1.1.hum1@aarch64, nodejs25-25.9.0-1.1.hum1@src, nodejs25-25.9.0-1.1.hum1@x86_64 +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:22380, RHSA-2026:22934, RHSA-2026:25561, RHSA-2026:7378
Not affected: 15 products
  • Cryostat 4
  • OpenShift Pipelines
  • Red Hat AMQ Broker 7
  • Red Hat Build of Podman Desktop
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat Openshift Data Foundation 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9675
  2. 2026-10-03 Alias added: GHSA-38rv-x7px-6hhq
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 3

Other 1

  • TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
  • TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
  • TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
  • TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
  • TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
  • TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences