EUVD-2026-11699
GHSA-vrm6-8vpv-qv8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish WebSocket connection with permessage-deflate
-
ExploitSend compressed decompression bomb frame
-
ExecutionUnbounded decompression exhausts memory
-
ImpactProcess crash or hang
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | WebSocket client must negotiate permessage-deflate extension during connection handshake. No authentication required; affects all undici WebSocket clients accepting compressed frames from remote servers. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Node.js undici WebSocket client denial-of-service via decompression bomb in permessage-deflate processing allows remote attackers to crash or hang affected processes through unbounded memory consumption. An attacker controlling a malicious WebSocket server can send specially crafted compressed frames that expand to extremely large sizes in memory without triggering any decompression limits. No patch is currently available for this vulnerability.
Earlier versions of this analysis (1)
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. [CVSS 7.5 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to e
Know when Undici gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
Lifecycle Timeline
2DescriptionCVE.org
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.
The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.
Blast Radius
ecosystem impact- 28 npm packages depend on undici (16 direct, 23 indirect)
Ecosystem-wide dependent count for version 7.0.0.
Executive ViewAI
CVE-2026-1526 affects the undici WebSocket client, allowing attackers to trigger uncontrolled memory consumption leading to service outages. Any application using undici for WebSocket communications is at risk of denial-of-service attacks until mitigation is implemented.
Disable permessage-deflate compression in WebSocket configurations; implement strict connection limits and timeouts for WebSocket clients; deploy memory usage monitoring and alerting; restrict WebSocket connections to trusted sources only via network segmentation or firewall rules; consider WAF rules to detect and block abnormal decompression patterns; implement rate limiting on incoming WebSocket connections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Undici WebSocket DoS and Protocol Vulnerabilities
View all 6undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions
Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0
Persistent cache poisoning and disclosure of user-specific responses affect undici 7.0.0 through 7.30.0 and 8.0.0 throug
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB