CVE-2026-1528

Modified Modified - Updated After Analysis

Integer Overflow in undici ByteParser Causes Process Crash

Publication date: 2026-03-12

Last updated on: 2026-07-02

Assigner: openjs

Description

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-12

Last Modified

2026-07-02

Generated

2026-07-06

AI Q&A

2026-03-12

EPSS Evaluated

2026-07-05

NVD

CVE-2026-1528

EUVD

EUVD-2026-11703

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	undici	to 6.24.0 (exc)
nodejs	undici	From 7.0.0 (inc) to 7.24.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-1528 is a high-severity vulnerability in the npm package "undici" affecting versions >= 6.0.0 and < 6.24.0, as well as >= 7.0.0 and < 7.24.0.'}, {'type': 'paragraph', 'content': "The issue occurs when a malicious server sends a WebSocket frame using the 64-bit length form with an extremely large length value. This causes undici's internal ByteParser to overflow its internal mathematical calculations, leading to an invalid parser state."}, {'type': 'paragraph', 'content': 'As a result, a fatal TypeError is thrown, which crashes the client process.'}, {'type': 'paragraph', 'content': 'The underlying weaknesses include uncaught exceptions and improper validation of the length field in the WebSocket frame.'}] [1]

Impact Analysis

This vulnerability can cause the client process using the undici package to crash unexpectedly due to a fatal TypeError triggered by a malicious WebSocket frame.

Attack Vector: Network - the vulnerability can be exploited remotely without any special conditions.
Privileges Required: null - no authentication or privileges are needed to exploit this.
User Interaction: null - exploitation does not require any user action.
Impact on Availability: High - the client process terminates, causing denial of service.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the undici package to version 6.24.0, 7.24.0, or later.

There are no known workarounds for this issue, so upgrading is the only effective mitigation.

Hi! I’m here to help you understand CVE-2026-1528. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70