Vulnerability · Published Mar 12, 2026 · Assigned by openjs

CVE-2026-1528undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

High 7.5

In plain English

A high-severity security flaw in undici from undici. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-devel	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-devel	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	nodejs-devel	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:10	nodejs-docs	1:22.22.2-1.el10_1	ALSA-2026:7080
AlmaLinux:8	nodejs-docs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs-docs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-docs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-full-i18n	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs-full-i18n	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-full-i18n	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-libs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs-libs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-libs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-nodemon	3.0.3-1.module_el8.10.0+4061+f8ceeab9	ALSA-2026:7670
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.10.0+4006+3c416519	ALSA-2026:7123
AlmaLinux:9	nodejs-nodemon	3.0.3-3.module_el9.7.0+209+ecf6523e	ALSA-2026:7350
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:7670
AlmaLinux:9	nodejs-packaging	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:7350
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:7670
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+198+8bf605ba	ALSA-2026:7350
AlmaLinux:10	nodejs24-docs	1:24.14.1-2.el10_1	ALSA-2026:7675
AlmaLinux:10	nodejs24-npm	1:11.11.0-1.24.14.1.2.el10_1	ALSA-2026:7675
AlmaLinux:8	npm	1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	npm	1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:9	npm	1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
Debian:13	node-undici	no fix listed	DEBIAN-CVE-2026-1528
Debian:14	node-undici	7.24.5+dfsg+~cs3.2.0-1	DEBIAN-CVE-2026-1528
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1667+4a788d89	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1823+b5789597	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1666+930e28e8	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1935+d3cbe60f	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1924+614dc87f	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.3-1.module+el8.10.0+2084+ab509703	RLSA-2026:7670
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:7123
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40018+a011993d	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2	RLSA-2026:7350
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:7670
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:7123
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7350
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7302
Rocky Linux:10	nodejs22	1:22.22.2-1.el10_1	RLSA-2026:7080
Rocky Linux:10	nodejs24	1:24.14.1-2.el10_1	RLSA-2026:7675
Ubuntu:24.04:LTS	node-undici	no fix listed	UBUNTU-CVE-2026-1528
Ubuntu:25.10	node-undici	no fix listed	UBUNTU-CVE-2026-1528
Ubuntu:26.04:LTS	node-undici	no fix listed	UBUNTU-CVE-2026-1528
Ubuntu:26.10	node-undici	no fix listed	UBUNTU-CVE-2026-1528
npm	undici	7.24.0	GHSA-f269-vfmq-vjvj
npm	undici	6.24.0	GHSA-f269-vfmq-vjvj

Affected products (as reported)

Vendor	Product	Versions
undici	undici	>= 6.0.0 < 6.24.0; 7.0.0 < 7.24.0

Weakness: CWE-248, CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
https://hackerone.com/reports/3537648
https://cna.openjsf.org/security-advisories.html
https://access.redhat.com/security/cve/CVE-2026-1528 vdb-entry, x_refsource_REDHAT
RHBZ#2447145 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1528.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:17789 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7310 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7080 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7675 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7123 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7670 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7983 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7302 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7350 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9742 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13826 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5807 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21931 vendor-advisory, x_refsource_REDHAT