CVE catalog
CVE-2026-1526
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.17% · Oct 25, 2026
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-undici | sid | 8.12.2+dfsg+~cs3.2.3-2 | fixed |
| Debian | node-undici | forky | 8.10.2+dfsg+~cs3.2.2-1 | fixed |
| Debian | node-undici | trixie | 7.3.0+dfsg1+~cs24.12.11-1 | vulnerable |
| Debian | node-undici | bookworm | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 | not affected |
| Debian | node-undici | bookworm-security | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 | not affected |
| Npm | undici | Not reported | 6.24.0 | fixed |
| Npm | undici | Not reported | 7.24.0 | fixed |
| Cpe | undici | Not reported | 7.24.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-undici | source | sid | 7.24.5+dfsg+~cs3.2.0-1 | not yet assigned | Not reported | [1130880] |
| Debian | node-undici | source | forky | 7.24.5+dfsg+~cs3.2.0-1 | not yet assigned | Not reported | [1130880] |
| Debian | node-undici | source | trixie | (unfixed) | not yet assigned | Not reported | [1130880] |
| Debian | node-undici | source | bookworm | Not affected | unimportant | Not reported | [1130880] |
| Npm | undici | npm | Not reported | 6.24.0 | Not reported | Not reported | Not reported |
| Npm | undici | npm | Not reported | 7.24.0 | Not reported | Not reported | Not reported |
| Cpe | undici | cpe | Not reported | 7.24.0 | Not reported | NVD-CVE-2026-1526 | Not reported |
Notes
[trixie] node-undici: Minor issue
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [libllhttp9.2]Affected
Source package: [node-undici]
Details (2)
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· amd64 · trixieAffected
nvd · node-undici · debian · 13
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· arm64 · trixieAffected
nvd · node-undici · debian · 13
- [libllhttp-dev]Affected
Source package: [node-undici]
Details (2)
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· amd64 · trixieAffected
nvd · node-undici · debian · 13
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· arm64 · trixieAffected
nvd · node-undici · debian · 13
- [node-llhttp]Affected
Source package: [node-undici]
Details (2)
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
9.2.1~7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
- [node-undici]Affected
Details (2)
7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
7.3.0+dfsg1+~cs24.12.11-1· all · trixieAffected
nvd · node-undici · debian · 13
[Debian 12 (Bookworm)]
- [node-llhttp]Not affected
Source package: [node-undici]
Details (4)
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
- [node-undici]Not affected
Details (4)
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4· all · bookwormNot affected
nvd · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3· all · bookworm-securityNot affected
nvd · node-undici · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_7080.json]
- [https://github.com/advisories/GHSA-vrm6-8vpv-qv8q]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-1526]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-1526]
- [https://security-tracker.debian.org/tracker/CVE-2026-1526]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1526.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0933.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]