CVE-2026-12151

What it is

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of service disruption.

Exploit odds

0.8% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-06-17 17:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-11 13:17 UTC Last updatedMost recent change to the record

Details

Published

2026-06-17 17:16 UTC

Last modified

2026-09-11 13:17 UTC

Exploit probability

0.8% · EPSS, next 30 days

Weakness

CWE-400 · Uncontrolled resource consumption

Record status

Modified

Affected

• Nodejs Undici < 6.27.0
• Nodejs Undici < 7.28.0
• Nodejs Undici < 8.5.0

Attack profile CVSS 3.1 · 7.5

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High