CVE-2026-9675 Details
Description
Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected. Patches: Upgrade to undici >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
A denial-of-service vulnerability has been identified in the undici WebSocket client, specifically in versions 8.0.0 prior to 8.5.0. The issue arises because the client enforces a maximum payload size for each frame but fails to consider the total size of fragmented uncompressed messages. This allows a malicious WebSocket server to send numerous small fragments that individually comply with the per-frame limit but collectively exceed it. As a result, this can lead to unbounded memory growth in the client process, causing memory exhaustion and a denial-of-service condition.
Users are advised to upgrade to undici version 8.5.0 or later. No workarounds are available.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq | openjs | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | openjs |
| CWE-770 | Allocation of Resources Without Limits or Throttling | openjs |
Affected Products
| Product | Versions |
|---|---|
| nodejs undici | >= 8.0.0, < 8.5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | openjs |