GitHub Advisoryadvisory · npm

GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

HIGH Published 2026-03-13 Modified 2026-03-13 Official page ↗
Aliases
CVE-2026-1528
Ecosystem
npm
Packages
undici
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1284, CWE-248
Reviewed
2026-03-13

Affected packages

• npm undici: >= 6.0.0, < 6.24.0 → fixed in 6.24.0 • npm undici: >= 7.0.0, < 7.24.0 → fixed in 7.24.0

Description

Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. Workarounds There are no workarounds.

Related

Alias · CVE (1)

  • CVE-2026-1528 ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. vulnerability

Weakness · CWE (2)

  • CWE-1284 Improper Validation of Specified Quantity in Input weakness
  • CWE-248 Uncaught Exception weakness

References