CVE-2026-1528
Received Received - Intake
Integer Overflow in undici ByteParser Causes Process Crash

Publication date: 2026-03-12

Last updated on: 2026-03-20

Assigner: openjs

Description
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-12
Last Modified
2026-03-20
Generated
2026-06-16
AI Q&A
2026-03-12
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1528
EUVD
EUVD-2026-11703
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
nodejs undici to 6.24.0 (exc)
nodejs undici From 7.0.0 (inc) to 7.24.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-248 An exception is thrown from a function, but it is not caught.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-1528 is a high-severity vulnerability in the npm package "undici" affecting versions >= 6.0.0 and < 6.24.0, as well as >= 7.0.0 and < 7.24.0.'}, {'type': 'paragraph', 'content': "The issue occurs when a malicious server sends a WebSocket frame using the 64-bit length form with an extremely large length value. This causes undici's internal ByteParser to overflow its internal mathematical calculations, leading to an invalid parser state."}, {'type': 'paragraph', 'content': 'As a result, a fatal TypeError is thrown, which crashes the client process.'}, {'type': 'paragraph', 'content': 'The underlying weaknesses include uncaught exceptions and improper validation of the length field in the WebSocket frame.'}] [1]

Impact Analysis

This vulnerability can cause the client process using the undici package to crash unexpectedly due to a fatal TypeError triggered by a malicious WebSocket frame.

  • Attack Vector: Network - the vulnerability can be exploited remotely without any special conditions.
  • Privileges Required: null - no authentication or privileges are needed to exploit this.
  • User Interaction: null - exploitation does not require any user action.
  • Impact on Availability: High - the client process terminates, causing denial of service.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the undici package to version 6.24.0, 7.24.0, or later.

There are no known workarounds for this issue, so upgrading is the only effective mitigation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart