CVE-2026-1526 — Undici vulnerability

Vendor	Product	Version range	Fixed in
debian	node-undici	< node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky)	node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky)
nodejs	undici	< 6.24.0	6.24.0
nodejs	undici	>= 7.0.0 < 7.24.0	7.24.0
undici	undici	< 6.24.0; 7.0.0 < 7.24.0	6.24.0; 7.0.0 < 7.24.0
undici	undici	>= 0 < 6.24.0	6.24.0
undici	undici	>= 7.0.0 < 7.24.0	7.24.0

OSV

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

osv·2026-03-13

CVE-2026-1526 [HIGH] Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression ## Description The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the `PerMessageDeflate.decompress()` method, which accumulates all decompressed chunks in memory and concatena

GHSA

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

ghsa·2026-03-13

CVE-2026-1526 [HIGH] CWE-409 Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression ## Description The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the `PerMessageDeflate.decompress()` method, which accumulates all decompressed chunks in memory and concatena

OSV

CVE-2026-1526: The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression

osv·2026-03-12·CVSS 7.5

CVE-2026-1526 [HIGH] CVE-2026-1526: The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Red Hat

undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression

vendor_redhat·2026-03-12·CVSS 7.5

CVE-2026-1526 [HIGH] CWE-770 undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory a

Debian

CVE-2026-1526: node-undici - The undici WebSocket client is vulnerable to a denial-of-service attack via unbo...

vendor_debian·2026·CVSS 7.5

CVE-2026-1526 [HIGH] CVE-2026-1526: node-undici - The undici WebSocket client is vulnerable to a denial-of-service attack via unbo... The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold. Scope: loc

CVE-2026-1526: The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a…

Affected

CVSS provenance