CVE-2026-1528
Integer Overflow in undici ByteParser Causes Process Crash
Publication date: 2026-03-12
Last updated on: 2026-03-20
Assigner: openjs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nodejs | undici | to 6.24.0 (exc) |
| nodejs | undici | From 7.0.0 (inc) to 7.24.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-248 | An exception is thrown from a function, but it is not caught. |
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-1528 is a high-severity vulnerability in the npm package "undici" affecting versions >= 6.0.0 and < 6.24.0, as well as >= 7.0.0 and < 7.24.0.'}, {'type': 'paragraph', 'content': "The issue occurs when a malicious server sends a WebSocket frame using the 64-bit length form with an extremely large length value. This causes undici's internal ByteParser to overflow its internal mathematical calculations, leading to an invalid parser state."}, {'type': 'paragraph', 'content': 'As a result, a fatal TypeError is thrown, which crashes the client process.'}, {'type': 'paragraph', 'content': 'The underlying weaknesses include uncaught exceptions and improper validation of the length field in the WebSocket frame.'}] [1]
How can this vulnerability impact me? :
This vulnerability can cause the client process using the undici package to crash unexpectedly due to a fatal TypeError triggered by a malicious WebSocket frame.
- Attack Vector: Network - the vulnerability can be exploited remotely without any special conditions.
- Privileges Required: null - no authentication or privileges are needed to exploit this.
- User Interaction: null - exploitation does not require any user action.
- Impact on Availability: High - the client process terminates, causing denial of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the undici package to version 6.24.0, 7.24.0, or later.
There are no known workarounds for this issue, so upgrading is the only effective mitigation.