Vulnerability Report

CVE-2026-12151

Title: undici WebSocket Client Denial of Service

DoS

Proof Of Concept

No public PoC currently indexed for CVE-2026-12151.

CWE Category CWE-400

Published Date Jun 17, 2026

Modified Date Jul 21, 2026

Exploit Status Not Found

Score 7.5 CVSS v3.1

Exploit Probability (EPSS)

0.79%

Vulnerability Summary

CVE-2026-12151: Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Impacted Vendors

nodejs 1

Reference Links

https://cna.openjsf.org/security-advisories.html https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q

CVSS v3.1

Source Entity ce714d77-add3-4f53-aff5-83d477b104bb

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H