Vulnerability · Published Mar 12, 2026 · Assigned by openjs

CVE-2026-1526undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

High 7.5

In plain English

A high-severity resource allocation without limits in undici from undici. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.2%top 31.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-devel	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-devel	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	nodejs-devel	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:10	nodejs-docs	1:22.22.2-1.el10_1	ALSA-2026:7080
AlmaLinux:8	nodejs-docs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs-docs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-docs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-full-i18n	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs-full-i18n	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-full-i18n	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-libs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs-libs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-libs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-nodemon	3.0.3-1.module_el8.10.0+4061+f8ceeab9	ALSA-2026:7670
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.10.0+4006+3c416519	ALSA-2026:7123
AlmaLinux:9	nodejs-nodemon	3.0.3-3.module_el9.7.0+209+ecf6523e	ALSA-2026:7350
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:7670
AlmaLinux:9	nodejs-packaging	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:7350
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:7670
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+198+8bf605ba	ALSA-2026:7350
AlmaLinux:10	nodejs24-docs	1:24.14.1-2.el10_1	ALSA-2026:7675
AlmaLinux:10	nodejs24-npm	1:11.11.0-1.24.14.1.2.el10_1	ALSA-2026:7675
AlmaLinux:8	npm	1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	npm	1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	npm	1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
Debian:13	node-undici	no fix listed	DEBIAN-CVE-2026-1526
Debian:14	node-undici	7.24.5+dfsg+~cs3.2.0-1	DEBIAN-CVE-2026-1526
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1667+4a788d89	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1823+b5789597	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1666+930e28e8	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1935+d3cbe60f	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1924+614dc87f	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.3-1.module+el8.10.0+2084+ab509703	RLSA-2026:7670
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:7123
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40018+a011993d	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2	RLSA-2026:7350
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:7670
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:7123
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7350
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7302
Rocky Linux:10	nodejs22	1:22.22.2-1.el10_1	RLSA-2026:7080
Rocky Linux:10	nodejs24	1:24.14.1-2.el10_1	RLSA-2026:7675
Ubuntu:24.04:LTS	node-undici	no fix listed	UBUNTU-CVE-2026-1526
Ubuntu:25.10	node-undici	no fix listed	UBUNTU-CVE-2026-1526
Ubuntu:26.04:LTS	node-undici	no fix listed	UBUNTU-CVE-2026-1526
Ubuntu:26.10	node-undici	no fix listed	UBUNTU-CVE-2026-1526
npm	undici	7.24.0	GHSA-vrm6-8vpv-qv8q
npm	undici	6.24.0	GHSA-vrm6-8vpv-qv8q

Affected products (as reported)

Vendor	Product	Versions
undici	undici	< 6.24.0; 7.0.0 < 7.24.0

Weakness: CWE-409, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q
https://hackerone.com/reports/3481206
https://cna.openjsf.org/security-advisories.html
https://datatracker.ietf.org/doc/html/rfc7692
https://access.redhat.com/security/cve/CVE-2026-1526 vdb-entry, x_refsource_REDHAT
RHBZ#2447142 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1526.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:17789 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7310 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7080 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7675 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7123 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7670 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7983 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7302 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7350 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9742 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13826 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5807 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21931 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56431 vendor-advisory, x_refsource_REDHAT