CVE-2026-109932: undici WebSocket client denial of service via unbounded PONG buffering

CVE-2026-109932 · Severity: medium · CVSS 5.9 · Published 2026-10-15

undici is an HTTP client library for Node.js that includes a WebSocket client. A malicious or compromised WebSocket server can exhaust the client's process memory by sending rapid PING frames while ignoring the client's PONG responses, causing the outbound write queue to grow without bound until the process runs out of memory and crashes. This is a remote denial of service attack that requires only a normal WebSocket connection and no authentication.

Technologies: undici (npm), OpenJS Foundation Undici. Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-109932 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109932 being exploited in the wild.
How severe is CVE-2026-109932?
Medium severity, with a CVSS score of 5.9, published 15 October 2026.
Which products and versions are affected?
undici (npm) >= 5.15.0, < 6.29.1, SEMVER:introduced=5.15.0,fixed=6.29.1; OpenJS Foundation Undici 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1.
Is there a fix for CVE-2026-109932?
Yes. undici (npm): upgrade to 6.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109932 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-109932?
Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • undici (npm): upgrade to 6.29.1 or later
    npm install undici@6.29.1

Technical details

The vulnerability exists in undici's WebSocket client implementation, which automatically responds to PING frames with PONG responses but fails to honor socket backpressure signals (the false return value from socket.write()). An attacker can send continuous PING frames while never reading PONGs, causing the outbound queue and heap to grow unbounded until memory exhaustion. The issue affects versions 5.15.0–6.29.0, 7.0.0–7.30.0, and 8.0.0–8.12.1; fixes pause frame parsing on backpressure and resume on drain.

Affected products

  • OpenJS Foundation undici 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1

Identifiers

  • CVE-2026-109932
  • GHSA-9fm3-97px-rjf6

Timeline

  • 2026-10-15: disclosed: Public advisory disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.