Is CVE-2026-9675 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9675 being exploited in the wild.

How severe is CVE-2026-9675?

High severity, with a CVSS score of 7.5, published 17 June 2026.

Which products and versions are affected?

undici (npm) >= 8.0.0, < 8.5.0, SEMVER:introduced=8.0.0,fixed=8.5.0.

Is there a fix for CVE-2026-9675?

Yes. undici (npm): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9675 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9675?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9675: Node.js undici denial of service via cumulative WebSocket fragment bypass

Q: Is there a fix for CVE-2026-9675?

Yes. undici (npm): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-9675 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-9675?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9675 · Severity: high · CVSS 7.5 · Published 2026-06-17

The undici WebSocket client is an HTTP/1.1 library used in Node.js applications to establish WebSocket connections. A malicious or compromised WebSocket server can send many small data fragments that individually pass validation but collectively exceed the configured message size limit, causing the client to consume unbounded memory and crash. Affected applications are only those using undici versions 8.0.0 through 8.4.x that connect to attacker-controlled WebSocket endpoints.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-9675 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9675 being exploited in the wild.
How severe is CVE-2026-9675?: High severity, with a CVSS score of 7.5, published 17 June 2026.
Which products and versions are affected?: undici (npm) >= 8.0.0, < 8.5.0, SEMVER:introduced=8.0.0,fixed=8.5.0.
Is there a fix for CVE-2026-9675?: Yes. undici (npm): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9675 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9675?: Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 8.5.0 or later
```
npm install undici@8.5.0
```

Technical details

The vulnerability is a resource exhaustion flaw (CWE-400, CWE-770) in the undici WebSocket client implementation. The client validates maxPayloadSize on a per-frame basis but does not track or enforce cumulative message size when processing fragmented (multi-frame) WebSocket messages. An attacker controlling or compromising a WebSocket endpoint can send a stream of small fragments, each passing individual frame validation, that together exceed the configured limit. This causes unbounded memory allocation on the client side, leading to memory exhaustion and process termination (denial of service). The attack requires network connectivity and the ability to induce a client to connect to a malicious or compromised endpoint; no authentication or user interaction is required once the connection is established. The vulnerability is a regression introduced in undici 8.1.0. Patched in version 8.5.0 and later; no workaround is available.

Affected products

nodejs undici 8.0.0 through 8.4.x

Identifiers

CVE-2026-9675
GHSA-38rv-x7px-6hhq

Timeline

2026-06-17: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-38rv-x7px-6hhq
2026-06-18: patched: Fixed in undici 8.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.