The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-develUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade v8-13.6-devel | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-debuginfoUpgrade nodejs22Upgrade v8-12.4-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-libsUpgrade nodejs24Upgrade nodejs22-docsUpgrade nodejs24-full-i18nUpgrade nodejs22-npmUpgrade nodejs22-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs22-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs24-docsUpgrade v8-13.6-develUpgrade nodejs22-devel | Jul 8, 2026 | Jun 17, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Aug 19, 2026 | Aug 18, 2026 |
| Redhat_linux | — | Upgrade nodejs22-debuginfoUpgrade npmUpgrade nodejs24-npmUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs24-docsUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs24-develUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs24Upgrade nodejs22-debugsourceUpgrade nodejs-devel | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade v8-12.4-develUpgrade nodejs-debuginfoUpgrade nodejs-npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs-develUpgrade nodejs22-debugsourceUpgrade nodejs24-develUpgrade nodejs-libsUpgrade nodejs24Upgrade v8-13.6-develUpgrade npmUpgrade nodejs24-debuginfo | Jul 10, 2026 | Jul 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub