What is the CVSS score of EUVD-2026-37752?

EUVD-2026-37752 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of undici are affected by EUVD-2026-37752?

CVE-2026-9675 affects undici, the Node.js WebSocket library, allowing unauthenticated attackers (malicious or compromised WebSocket servers) to crash client applications through memory exhaustion.. A patch is available.

How to fix or mitigate EUVD-2026-37752?

Within 24 hours: Inventory all Node.js applications and verify undici versions in use; document which systems connect to external WebSocket servers. Within 7 days: Restrict WebSocket connections to trusted internal servers only; implement per-process memory limits and connection timeouts at application or container level. Within 30 days: Continuously monitor vendor security bulletins for patch availability; prepare upgrade plan to patched version when released.

undici EUVD-2026-37752

| CVE-2026-9675 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-17 openjs

GHSA-38rv-x7px-6hhq

Denial Of Service Undici Red Hat

7.5

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable malicious server, no authentication or user interaction on the client beyond initiating the connection, availability-only impact via memory exhaustion, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 18, 2026 - 17:02 EUVD

Analysis Generated

Jun 17, 2026 - 16:55 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on undici (1 direct, 1 indirect)

Ecosystem-wide dependent count for version 8.0.0.

DescriptionCVE.org

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected.

Patches: Upgrade to undici >= 8.5.0.

Workarounds: No workaround is available. The fix must be applied through an upgrade.

AnalysisAI

Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior to 8.5.0 allows a malicious or compromised WebSocket server to exhaust client memory by streaming many small fragmented frames that individually pass the per-frame maxPayloadSize check but cumulatively bypass any size limit. The flaw is a regression introduced in the 8.1.0 line; no public exploit identified at time of analysis. Impact is limited to availability (process crash via memory exhaustion) with no confidentiality or integrity consequence per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector.

Technical ContextAI

undici is the official high-performance HTTP/1.1 and WebSocket client used by modern Node.js runtimes (and exposed via the built-in fetch and WebSocket globals). The WebSocket protocol (RFC 6455) permits a single logical message to be split across many continuation frames; the receiving implementation must buffer fragments until the FIN bit arrives. The maxPayloadSize option in undici was intended to bound this buffering, but the check was applied only to individual frame sizes rather than the running total of an in-progress fragmented message - a classic CWE-400 (Uncontrolled Resource Consumption) accounting bug. The 6.25.0 line shipped the cumulative check correctly and the 7.x line never had the maxPayloadSize feature, so the defect is isolated to the 8.x branch starting at 8.1.0. Affected CPE is cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:* covering all 8.1.0-8.4.x releases.

RemediationAI

Vendor-released patch: undici 8.5.0 - upgrade the direct or transitive undici dependency to >= 8.5.0 per the maintainer advisory at https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq. The advisory explicitly states no workaround is available because the per-frame check cannot be reconfigured to enforce cumulative limits without the code fix; downgrading to 6.25.0 is an alternative for projects that can tolerate the older API surface, and migrating to the 7.x line is also unaffected. For applications that cannot upgrade immediately, the only meaningful compensating control is to restrict outbound WebSocket destinations via an egress allow-list or proxy so the client cannot be coerced into connecting to attacker-controlled endpoints - note this breaks any feature that legitimately consumes user-supplied WebSocket URLs. Process-level memory limits (container cgroup memory caps, Node's --max-old-space-size) will convert the exhaustion into a faster, more contained crash rather than preventing the DoS.