Executive brief
The undici WebSocket client is an HTTP/1.1 library used in Node.js applications to establish WebSocket connections. A malicious or compromised WebSocket server can send many small data fragments that individually pass validation but collectively exceed the configured message size limit, causing the client to consume unbounded memory and crash. Affected applications are only those using undici versions 8.0.0 through 8.4.x that connect to attacker-controlled WebSocket endpoints.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400, CWE-770) in the undici WebSocket client implementation. The client validates maxPayloadSize on a per-frame basis but does not track or enforce cumulative message size when processing fragmented (multi-frame) WebSocket messages. An attacker controlling or compromising a WebSocket endpoint can send a stream of small fragments, each passing individual frame validation, that together exceed the configured limit. This causes unbounded memory allocation on the client side, leading to memory exhaustion and process termination (denial of service). The attack requires network connectivity and the ability to induce a client to connect to a malicious or compromised endpoint; no authentication or user interaction is required once the connection is established. The vulnerability is a regression introduced in undici 8.1.0. Patched in version 8.5.0 and later; no workaround is available.
Affected products
- nodejs undici 8.0.0 through 8.4.x
Timeline
- 2026-06-17: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-38rv-x7px-6hhq
- 2026-06-18: patched: Fixed in undici 8.5.0