CVE-2026-109932

Medium · 5.9

CVSS

5.9

EPSS

0.3%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the way some Node.js programs handle WebSocket messages lets a remote server send tiny requests that make the program use more and more memory until it crashes.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Moderate
Impact: Denial Of Service
Component: Library
Class: Denial of service
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

WebSocket client ignores socket backpressure on automatic PONG responses to inbound PING frames, causing unbounded growth of the outbound write queue and heap until the Node.js process OOMs.

Why it matters to the business

Node.js services using WebSocket clients can be crashed remotely, leading to unplanned downtime and loss of availability for affected applications with no data loss or code execution.

How an attack unfolds

An attacker hosts or compromises a WebSocket server, waits for a vulnerable client connection, then streams many small PING frames while discarding all inbound PONG responses; the client’s ignored backpressure causes memory to grow until the process terminates.

How to fix it

Upgrade undici to 6.29.1, 7.30.1 or 8.12.2 (or later). For Red Hat nodejs24-main apply 24.21.0-1.5.hum1 via RHSA-2026:84706; for nodejs26-main apply 26.12.1-0.1.hum1 via the same advisory. No workaround exists.

How to confirm the fix worked

Confirm installed undici/Node.js package versions match or exceed the fixed releases listed in RHSA-2026:84706; perform a controlled WebSocket test that exercises backpressure to verify the outbound queue remains bounded.

Typical attack path

Establish a standard WebSocket connection to the victim client
Send a continuous stream of small PING frames
Never read or acknowledge the client’s automatic PONG replies
Observe unbounded outbound queue and heap growth on the client
Trigger process termination when memory is exhausted

How to detect it

Review Node.js process memory usage and GC logs for sustained growth during active WebSocket sessions; correlate with inbound PING-heavy traffic from external endpoints.

What your security team should do

Apply the Red Hat updates for nodejs24-main and nodejs26-main within the next 7 days given 14-day publication window and public fix availability
Inventory all Node.js applications that initiate outbound WebSocket connections and prioritize patching those reachable from untrusted networks
Add package-version checks to CI/CD pipelines to block builds using vulnerable undici ranges
Monitor Node.js process memory metrics for sudden spikes correlated with WebSocket traffic

The record

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.

Affected packages

Ecosystem	Package	Introduced	Fixed