undici WebSocket client vulnerable to denial of service via fragment count bypass
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 22 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00789 56th percentileScored 2026-11-07
Fix Partial undici (undici): 6.26.0, 7.28.0, 8.5.0undici (npm): 6.27.0, 7.28.0, 8.5.0Red Hat: 29 advisoriesRed Hat: 22 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | undici | before 6.26.0; 7.0.0 to before 7.28.0; 8.0.0 to before 8.5.0 | 6.26.0, 7.28.0, 8.5.0 | Patch available | CNA |
| — | undici (npm) | before 6.27.0 | 6.27.0 | Patch available | GHSA-vxpw-j846-p89q |
| — | undici (npm) | 7.0.0 to before 7.28.0 | 7.28.0 | Patch available | GHSA-vxpw-j846-p89q |
| — | undici (npm) | 8.0.0 to before 8.5.0 | 8.5.0 | Patch available | GHSA-vxpw-j846-p89q |
- undici VendorNodeJS Affected before 6.26.0; 7.0.0 to before 7.28.0; 8.0.0 to before 8.5.0 Fixed in 6.26.0, 7.28.0, 8.5.0 Patch available CNA
- undici (npm) Vendor— Affected before 6.27.0 Fixed in 6.27.0 Patch available GHSA-vxpw-j846-p89q
- undici (npm) Vendor— Affected 7.0.0 to before 7.28.0 Fixed in 7.28.0 Patch available GHSA-vxpw-j846-p89q
- undici (npm) Vendor— Affected 8.0.0 to before 8.5.0 Fixed in 8.5.0 Patch available GHSA-vxpw-j846-p89q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* | 6.17.0 to before 6.27.0; 7.0.0 to before 7.28.0; 8.0.0 to before 8.5.0 | Vulnerable | NodeJS |
- cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions 6.17.0 to before 6.27.0; 7.0.0 to before 7.28.0; 8.0.0 to before 8.5.0 Vulnerable ·NodeJS
Remediation
- Fix · CNA undici (undici) Fixed in 6.26.0, 7.28.0, 8.5.0
- Fix · GHSA-vxpw-j846-p89q undici (npm) Fixed in 6.27.0 Advisory →
- Fix · GHSA-vxpw-j846-p89q undici (npm) Fixed in 7.28.0 Advisory →
- Fix · GHSA-vxpw-j846-p89q undici (npm) Fixed in 8.5.0 Advisory →
Red Hat 29 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
Show 26 more Red Hat advisories
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:57013 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:56366 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:52399 Released 2026-08-10 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22 +28
- RHSA-2026:47728 Released 2026-08-06 · Red Hat rating CriticalOpenShift Container Platform 4.17.56 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9 +7
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:48124 Released 2026-07-29 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.1 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
- RHSA-2026:41947 Released 2026-07-20 · Red Hat rating Importantnodejs:22 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.aarch64::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.ppc64le::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.s390x::nodejs:22 +28
- RHSA-2026:41929 Released 2026-07-20 · Red Hat rating ImportantRed Hat Developer Hub 1.9.7 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:36621 Released 2026-07-16 · Red Hat rating ImportantOpenShift Container Platform 4.16.66 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +4
- RHSA-2026:39868 Released 2026-07-15 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.aarch64::nodejs:24, nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.ppc64le::nodejs:24, nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.s390x::nodejs:24 +25
- RHSA-2026:39246 Released 2026-07-14 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.23.1-2.el10_0, nodejs-devel-1:22.23.1-2.el10_0, nodejs-docs-1:22.23.1-2.el10_0 +4
- RHSA-2026:38236 Released 2026-07-11 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs24-1:24.18.0-0.3.hum1@aarch64, nodejs24-1:24.18.0-0.3.hum1@src, nodejs24-1:24.18.0-0.3.hum1@x86_64 +16
- RHSA-2026:38009 Released 2026-07-10 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs26-1:26.5.0-1.3.hum1@aarch64, nodejs26-1:26.5.0-1.3.hum1@src, nodejs26-1:26.5.0-1.3.hum1@x86_64 +14
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:36754 Released 2026-07-08 · Red Hat rating ImportantRed Hat Developer Hub 1.10.2 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:35892 Released 2026-07-06 · Red Hat rating Importantnodejs:22 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.aarch64::nodejs:22, nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.ppc64le::nodejs:22, nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.s390x::nodejs:22 +28
- RHSA-2026:35891 Released 2026-07-06 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.aarch64::nodejs:24, nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.ppc64le::nodejs:24, nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.s390x::nodejs:24 +25
- RHSA-2026:35842 Released 2026-07-06 · Red Hat rating Importantnodejs22 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.23.1-2.el10_2, nodejs-devel-1:22.23.1-2.el10_2, nodejs-docs-1:22.23.1-2.el10_2 +4
- RHSA-2026:35841 Released 2026-07-06 · Red Hat rating Importantnodejs24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-1.el10_2, nodejs24-devel-1:24.18.0-1.el10_2, nodejs24-docs-1:24.18.0-1.el10_2 +3
- RHSA-2026:34342 Released 2026-07-01 · Red Hat rating CriticalCluster Observability Operator 1.5.0
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
undici 6.26.0, 7.28.0, 8.5.0
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-08490 undici vulnerable to HTTP header injection via Set-Cookie percent-decodingPriority LOW 26
- TI-2026-09954 undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingPriority LOW 17
- TI-2026-05899 undici vulnerable to HTTP response queue poisoning via keep-alive socket reusePriority LOW 17
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:34342 |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:36754 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:41929 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:35841, RHSA-2026:35842 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:39868, RHSA-2026:41947 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:35891, RHSA-2026:35892 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:39246 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:52399 |
| Red Hat Hardened Images | Fixed | RHSA-2026:38009, RHSA-2026:38236 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126, RHSA-2026:87410 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520, RHSA-2026:84734 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:36621 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:47728 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820, RHSA-2026:48124 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:56366 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:57013 |
Not affected: 19 products
- Cluster Observability Operator 1.5
- Cryostat 4
- Cryostat 4 on RHEL 9
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12151
- 2026-10-03 Alias added: GHSA-vxpw-j846-p89q
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-04 33 new references · GHSA-vxpw-j846-p89q
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
Advisory 3
Other 34
- https://github.com/nodejs/undici/commit/32dbf0b3dd93daf6d87badf506d52e89f2e20e78
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:56431
- https://access.redhat.com/errata/RHSA-2026:57013
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-12151
- https://bugzilla.redhat.com/show_bug.cgi?id=2489980
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v6.27.0
- https://github.com/nodejs/undici/releases/tag/v7.28.0
- https://github.com/nodejs/undici/releases/tag/v8.5.0
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.json
- https://access.redhat.com/errata/RHSA-2026:35841
- https://access.redhat.com/errata/RHSA-2026:35842
- https://access.redhat.com/errata/RHSA-2026:35891
- https://access.redhat.com/errata/RHSA-2026:35892
- https://access.redhat.com/errata/RHSA-2026:36621
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:38009
- https://access.redhat.com/errata/RHSA-2026:38236
- https://access.redhat.com/errata/RHSA-2026:39246
- https://access.redhat.com/errata/RHSA-2026:39868
- https://access.redhat.com/errata/RHSA-2026:41929
- https://access.redhat.com/errata/RHSA-2026:41947
- https://access.redhat.com/errata/RHSA-2026:47728
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:52399
- https://access.redhat.com/errata/RHSA-2026:56366
More NodeJS Undici vulnerabilities
- TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
- TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
- TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
- TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
- TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
- TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-12151 · CVE Program
- CVE-2026-12151 · NVD
- FIRST EPSS
- GHSA-vxpw-j846-p89q · GitHub Advisory Database · CC BY 4.0
- CVE-2026-12151 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences