undici CVE-2026-109932

Requires an application using undici's WebSocket client - or the WebSocket bundled with and exposed by Node.js - in an affected version (5.15.0 through 6.29.0, 7.0.0 through 7.30.0, or 8.0.0 through 8.12.1) to establish and maintain a WebSocket connection to a server the attacker controls or has compromised. The server must stream many small PING frames while refusing to read the client's PONG responses; the client's automatic PONG reply and its ignoring of socket write backpressure are default behavior, so no special client configuration is needed. The key limiting factor is directional: this is a client-side flaw, so exploitation depends on the victim connecting outbound to a hostile WebSocket endpoint rather than on an attacker reaching a listening service, and the only outcome is a crash (availability). No workaround exists; mitigation is upgrading to 6.29.1, 7.30.1, 8.12.2, or later.

This is a genuine but moderate-priority availability issue, correctly rated medium (CVSS 5.9). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H is internally consistent with the description: remote (AV:N) and unauthenticated (PR:N), but with high attack complexity (AC:H) because this is a CLIENT-side flaw - the attacker does not attack a listening service but instead must get the victim's undici WebSocket client to connect to an attacker-controlled or compromised server, a precondition outside the attacker's sole control. Impact is availability-only (C:N/I:N/A:H), matching the CWE-400 uncontrolled-resource-consumption (unbounded outbound PONG queue → OOM process termination). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no KEV listing and no POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' Net: a real, patchable DoS worth remediating promptly given undici's enormous install base, but it is not an emergency - it causes a crash, not compromise, and requires the specific condition of connecting outbound to a hostile WebSocket endpoint rather than a widely-sprayable server-side exploit.

An application using undici's WebSocket client (or Node.js's bundled global WebSocket) connects to a WebSocket endpoint the attacker controls or has compromised. The malicious server streams a continuous flood of small PING frames while never reading the client's PONG replies; undici auto-generates a PONG for each PING and ignores socket write backpressure, so the outbound queue and heap grow without bound until the Node.js process exhausts memory and terminates. No public exploit code is identified, but the technique is simple and fully described in the advisory.