Junglewise Threat Intelligence

CVE-2026-1526: Node.js undici DoS via unbounded WebSocket decompression memory consumption

CVE-2026-1526 · Severity: high · CVSS 7.5 · Published 2026-03-12

Executive brief

The undici WebSocket client, a popular tool for handling web connections in Node.js applications, is vulnerable to a denial-of-service attack. A malicious server can send a specially crafted, highly compressed message (known as a "decompression bomb") that forces the client to consume massive amounts of memory. This can cause the application to crash or become completely unresponsive, potentially disrupting business operations and service availability.

Technical details

The vulnerability is classified as a resource exhaustion issue (CWE-409/CWE-770) within the undici WebSocket client's handling of the 'permessage-deflate' extension. Specifically, the PerMessageDeflate.decompress() method fails to enforce limits on the size of decompressed data, accumulating chunks in memory before concatenation. A remote attacker controlling a WebSocket server can exploit this by sending a small compressed frame that expands significantly upon decompression. This results in unbounded memory consumption, leading to a process crash (OOM) or system unresponsiveness. The attack requires no authentication and is reachable over the network if the client connects to a malicious endpoint.

Affected products

  • Node.js undici

Timeline

  • 2026-03-12: advisory: Advisory published by OpenJS Foundation and NVD

References