GHSA-vxpw-j846-p89q — undici WebSocket client vulnerable to denial of service via fragment count bypass

2026-09-29T17:12:05.388444+00:00

Affected: npm: undici

## Impact

The undici WebSocket client enforces `maxPayloadSize` on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (`new WebSocket(...)`) or the `WebSocketStream` API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

All releases starting at undici 6.17.0 are affected.

## Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

## Workarounds

No workaround is available. The fix must be applied through an upgrade.

Most recent entries from all

GHSA-vxpw-j846-p89q — undici WebSocket client vulnerable to denial of service via fragment count bypass