CVE-2026-1526

Modified Modified - Updated After Analysis

Unbounded Memory Consumption DoS in undici WebSocket Client

Publication date: 2026-03-12

Last updated on: 2026-07-02

Assigner: openjs

Description

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-12

Last Modified

2026-07-02

Generated

2026-07-06

AI Q&A

2026-03-12

EPSS Evaluated

2026-07-05

NVD

CVE-2026-1526

EUVD

EUVD-2026-11699

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	undici	to 6.24.0 (exc)
nodejs	undici	From 7.0.0 (inc) to 7.24.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

[{'type': 'paragraph', 'content': 'This vulnerability affects the undici WebSocket client library when it uses the permessage-deflate extension to decompress incoming compressed WebSocket frames.'}, {'type': 'paragraph', 'content': 'The issue lies in the PerMessageDeflate.decompress() method, which decompresses incoming data without enforcing any limit on the size of the decompressed output.'}, {'type': 'paragraph', 'content': 'A malicious WebSocket server can exploit this by sending a small compressed frame that expands into a very large amount of data in memory, known as a "decompression bomb."'}, {'type': 'paragraph', 'content': 'This causes the Node.js process using undici to consume excessive memory, potentially crashing or becoming unresponsive due to memory exhaustion.'}] [1]

Impact Analysis

The vulnerability can lead to a remote denial-of-service (DoS) attack against any Node.js application using the undici WebSocket client.

By sending a specially crafted compressed frame, an attacker can cause the application to consume unbounded memory, exhausting native or external memory resources.

This memory exhaustion can cause the Node.js process to crash or become unresponsive, disrupting service availability.

There are no application-level mitigations or workarounds because the decompression happens before message delivery.

Compliance Impact

I don't know

Detection Guidance

There are no specific detection commands or network indicators provided for this vulnerability because the issue occurs during the decompression of WebSocket frames within the undici WebSocket client. The attack involves a malicious server sending a small compressed frame that expands to a very large size in memory, causing the Node.js process to exhaust memory and crash or become unresponsive.

Since the vulnerability manifests as unbounded memory consumption and process crashes or unresponsiveness, monitoring Node.js application memory usage and crash logs may help detect exploitation attempts.

No application-level mitigations or workarounds exist because decompression happens before message delivery, and no specific commands for detection are documented.

Mitigation Strategies

The immediate and recommended mitigation is to upgrade the undici WebSocket client library to a patched version.

Upgrade to undici version 6.24.0 or later if using the 6.x series.
Upgrade to undici version 7.24.0 or later if using the 7.x series.

No application-level mitigations or workarounds exist because the decompression occurs before message delivery, so patching is the only effective solution.

Hi! I’m here to help you understand CVE-2026-1526. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70