CVE catalog

CVE-2026-9675

Severity: High · CVSS 7.5
Published: Apr 10, 2026, 1:03:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.43% · Oct 25, 2026

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected. Patches: Upgrade to undici >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-undici	sid	`8.12.2+dfsg+~cs3.2.3-2`	not affected
Debian	node-undici	forky	`8.10.2+dfsg+~cs3.2.2-1`	not affected
Debian	node-undici	trixie	`7.3.0+dfsg1+~cs24.12.11-1`	not affected
Debian	node-undici	bookworm	`5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4`	not affected
Debian	node-undici	bookworm-security	`5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3`	not affected
Cpe	undici	Not reported	`8.5.0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-undici	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	node-undici	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	node-undici	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	node-undici	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Cpe	undici	cpe	Not reported	`8.5.0`	Not reported	Not reported	Not reported

Notes

[trixie] node-undici: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[node-llhttp]Not affected
Source package: [node-undici]
Details (4)
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm
- 8.1.0~5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm
[node-undici]Not affected
Details (4)
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 · all · bookworm
  Not affected
  nvd · node-undici · debian · bookworm
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm
- 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 · all · bookworm-security
  Not affected
  nvd · node-undici · debian · bookworm

Observed: Oct 23, 2026, 10:34:23 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]