What is the CVSS score of CVE-2026-1528?

CVE-2026-1528 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Undici are affected by CVE-2026-1528?

CVE-2026-1528 affects applications using the undici HTTP client library, where attackers can crash servers by sending specially crafted WebSocket frames, causing service disruption.. A patch is available.

How to fix or mitigate CVE-2026-1528?

Within 24 hours: Inventory all systems using undici library and assess WebSocket exposure. Within 7 days: Implement network-level controls to restrict WebSocket traffic and deploy monitoring for abnormal frame sizes; contact undici maintainers for patch timeline. Within 30 days: Migrate to patched version immediately upon release, or evaluate alternative HTTP client libraries if patch is delayed.

Undici CVE-2026-1528

EUVD-2026-11703 HIGH

Uncaught Exception (CWE-248)

2026-03-12 ce714d77-add3-4f53-aff5-83d477b104bb

GHSA-f269-vfmq-vjvj

Buffer Overflow Undici

7.5

CVSS 3.1 · Vendor: ce714d77-add3-4f53-aff5-83d477b104bb

Severity by source

Vendor (ce714d77-add3-4f53-aff5-83d477b104bb) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).

CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 12, 2026 - 22:55 euvd

EUVD-2026-11703

Analysis Generated

Mar 12, 2026 - 22:55 vuln.today

CVE Published

Mar 12, 2026 - 21:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on undici (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.0.0.

DescriptionCVE.org

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

AnalysisAI

Undici's WebSocket frame parser fails to properly validate 64-bit length fields, causing integer overflow in internal calculations that leaves the parser in an invalid state and crashes the process with a fatal TypeError. An unauthenticated remote attacker can exploit this to achieve denial of service by sending a specially crafted WebSocket frame. Versions 7.24.0, 6.24.0, and later contain fixes for this vulnerability.