# CVE-2026-9675: Node.js undici denial of service via cumulative WebSocket fragment bypass

Source: https://junglewise.ai/threats/cve-2026-9675-node-js-undici-denial-of-service-via-cumulative-websocket-fragment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-9675 · Severity: high · CVSS 7.5 · Published 2026-06-17

The undici WebSocket client is an HTTP/1.1 library used in Node.js applications to establish WebSocket connections. A malicious or compromised WebSocket server can send many small data fragments that individually pass validation but collectively exceed the configured message size limit, causing the client to consume unbounded memory and crash. Affected applications are only those using undici versions 8.0.0 through 8.4.x that connect to attacker-controlled WebSocket endpoints.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-9675 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9675 being exploited in the wild.

**How severe is CVE-2026-9675?** High severity, with a CVSS score of 7.5, published 17 June 2026.

**Which products and versions are affected?** undici (npm) >= 8.0.0, < 8.5.0, SEMVER:introduced=8.0.0,fixed=8.5.0.

**Is there a fix for CVE-2026-9675?** Yes. undici (npm): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9675 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9675?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 8.5.0 or later

  ```sh
  npm install undici@8.5.0
  ```


## Technical details

The vulnerability is a resource exhaustion flaw (CWE-400, CWE-770) in the undici WebSocket client implementation. The client validates maxPayloadSize on a per-frame basis but does not track or enforce cumulative message size when processing fragmented (multi-frame) WebSocket messages. An attacker controlling or compromising a WebSocket endpoint can send a stream of small fragments, each passing individual frame validation, that together exceed the configured limit. This causes unbounded memory allocation on the client side, leading to memory exhaustion and process termination (denial of service). The attack requires network connectivity and the ability to induce a client to connect to a malicious or compromised endpoint; no authentication or user interaction is required once the connection is established. The vulnerability is a regression introduced in undici 8.1.0. Patched in version 8.5.0 and later; no workaround is available.

## Affected products

- nodejs undici 8.0.0 through 8.4.x

## Identifiers

- CVE-2026-9675
- GHSA-38rv-x7px-6hhq

## Timeline

- 2026-06-17: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-38rv-x7px-6hhq
- 2026-06-18: patched: Fixed in undici 8.5.0

## References

- [https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq](https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq)
- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici](https://github.com/nodejs/undici)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)