ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemon | Apr 16, 2026 | Apr 8, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-develUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-docsUpgrade nodejs24-libsUpgrade nodejs20-docsUpgrade nodejs22-debuginfoUpgrade nodejs22-develUpgrade nodejs20-libsUpgrade nodejs22-debugsourceUpgrade v8-13.6-develUpgrade nodejs22Upgrade nodejs24-npmUpgrade nodejs20Upgrade nodejs20-npmUpgrade nodejs20-debuginfoUpgrade v8-11.3-develUpgrade nodejs24Upgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs22-npmUpgrade nodejs20-full-i18nUpgrade nodejs22-full-i18nUpgrade v8-12.4-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-libsUpgrade nodejs20-devel | Apr 7, 2026 | Mar 12, 2026 |
| Oracle_linux | — | Upgrade v8-13.6-develUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs24-docsUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs24-libsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs24-npmUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade npmUpgrade nodejs24-develUpgrade nodejs | Apr 22, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-npmUpgrade nodejs24-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs22-debugsourceUpgrade npmUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs24-npmUpgrade nodejs-libs | Apr 9, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-develUpgrade nodejs22-debuginfoUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs22-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade v8-12.4-develUpgrade nodejs24-debuginfoUpgrade nodejs24-full-i18n | Apr 13, 2026 | Apr 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub