CVE-2026-1528

What it actually does

undici's WebSocket ByteParser performs unchecked arithmetic on the 64-bit payload-length form. A peer that advertises an extremely large length overflows that math, leaves the parser in an invalid state, and throws an uncaught TypeError that terminates the Node.js process. Confidentiality and integrity are unaffected; the sole impact is complete loss of process availability.

Why it matters to the business

Any Node.js service that uses undici to open WebSocket connections can be crashed by a remote peer, causing outages, dropped sessions, and worker restarts. undici is a core HTTP and WebSocket client in the Node.js ecosystem, so the blast radius includes direct and transitive dependents. The issue is not listed in CISA KEV, has no known in-the-wild exploitation, and a low, flat EPSS (~0.49%), but it has been public for about 200 days and remains a simple availability risk until patched.

How an attack unfolds

An attacker who can make a vulnerable undici client complete a WebSocket handshake to an endpoint they control (malicious or user-supplied URL, compromised legitimate server, or on-path position) finishes the handshake normally, then replies with a WebSocket frame that uses the 64-bit length encoding and an extremely large length value. ByteParser overflows, enters an invalid state, and throws a TypeError that typical application error handling does not catch, killing the process. No credentials, data theft, or code execution are required; the objective is process termination.

How to fix it

Upgrade undici to v7.24.0 or later on the 7.x line, or to v6.24.0 or later on the 6.x line, and redeploy so lockfiles, containers, and bundled copies pick up the patch. There is no configuration-only fix in vulnerable versions. Until upgraded, do not open WebSocket connections to untrusted or user-influenced URLs, restrict outbound WebSocket destinations, and run the process under a supervisor so a crash restarts the worker.

How to confirm the fix worked

Confirm installed undici is >= 7.24.0 or >= 6.24.0 via npm ls undici, package-lock.json / yarn.lock / pnpm-lock.yaml, and node_modules/undici/package.json, including transitive copies. Rebuild and redeploy images that vendor undici. After upgrade, open a WebSocket to a trusted server and confirm the process stays up. Search lockfiles and SBOM/image scans for undici 6.x below 6.24.0 and 7.x below 7.24.0.

Typical attack path

1. Find a Node.js application using a vulnerable undici release that initiates outbound WebSocket connections.
2. Cause that client to connect to an attacker-controlled WebSocket endpoint (untrusted URL, compromised server, or network interception).
3. Complete a normal WebSocket handshake.
4. Send a WebSocket frame that uses the 64-bit payload-length form with an extremely large length.
5. Observe the client process exit with an uncaught TypeError from ByteParser.

How to detect it

No in-the-wild exploitation is reported (exploit maturity none, not in KEV, low flat EPSS). Hunt historically for sudden Node.js process exits coinciding with outbound WebSocket use: uncaught TypeError stack traces naming undici ByteParser or the WebSocket parser, supervisor/orchestrator restart storms on WebSocket client workloads, and core dumps or stderr from those processes. Correlate crashes with connections to unusual WebSocket endpoints. Absence of those artifacts does not prove non-exposure; it only suggests this crash path was not observed.

• ByteParser
• uncaught TypeError
• TypeError
• undici
• WebSocket
• node_modules/undici
• websocket
• FATAL ERROR
• process exit

What your security team should do

• Inventory Node.js apps, lockfiles, and container images for undici 6.x < 6.24.0 and 7.x < 7.24.0, including transitive dependencies.
• Patch first those services that open WebSockets to third-party or user-influenced URLs.
• Upgrade to undici v6.24.0+ or v7.24.0+ and redeploy.
• Ensure process managers and orchestration liveness/restart policies recover crashed workers.
• Alert on uncaught TypeError crashes on WebSocket client paths until the fleet is patched.