CVE-2026-1528: undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. ### Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ### Workarounds There are no workarounds.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1528?
CVE-2026-1528 has a high severity rating due to the potential for crashes and disruption of client operations.
How do I fix CVE-2026-1528?
To fix CVE-2026-1528, upgrade to undici version 7.24.1 or later, or 6.24.1 or later.
What versions of undici are affected by CVE-2026-1528?
CVE-2026-1528 affects undici versions up to 6.24.0 and 7.24.0 exclusively.
What impact does CVE-2026-1528 have on applications?
CVE-2026-1528 can cause the client to crash if a malicious WebSocket frame with a large length is processed.
Is CVE-2026-1528 related to WebSocket behavior?
Yes, CVE-2026-1528 arises from the handling of 64-bit length fields in WebSocket frames by the undici parser.