Skip to content
Fencer Vulns
high 7.5

CVE-2026-12151 json

undici WebSocket client vulnerable to denial of service via fragment count bypass

published 2026-06-17 4 mo ago modified 2026-11-04 5 d ago also GHSA-vxpw-j846-p89q , EUVD-2026-37747

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

All releases starting at undici 6.17.0 are affected.

Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Patch / fix

  • npm undici 6.27.0, 7.28.0, 8.5.0
  • undici undici 6.26.0, 7.28.0, 8.5.0
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-13
  • Red Hat Red Hat Enterprise Linux 10 1:22.23.1-2.el10_2, 1:24.18.0-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 1:22.23.1-2.el10_0
  • Red Hat Red Hat Enterprise Linux 8 8100020260630152626.6d880403, 8100020260703140402.6d880403
  • Red Hat Red Hat Enterprise Linux 9 9080020260626074955.rhel9, 9080020260626075442.rhel9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260804140259.rhel9
  • Red Hat Cluster Observability Operator 1.5.0 1782838476, 1782838753, 1782839193, 1782839279, 1782839494, 1782839658, 1782839981, 1782839996, 1782840519, 1782840539, 1782841925, 1782844225
  • Red Hat Red Hat Developer Hub 1.10 1783448184
  • Red Hat Red Hat Developer Hub 1.9 1784210921
  • Red Hat Red Hat Hardened Images 24.18.0-0.3.hum1, 26.5.0-1.3.hum1
  • Red Hat Red Hat OpenShift AI 2.25 1787801527
  • Red Hat Red Hat OpenShift AI 3.4 1787121387
  • Red Hat Red Hat OpenShift Container Platform 4.16 1783306396
  • Red Hat Red Hat OpenShift Container Platform 4.17 1784744859
  • Red Hat Red Hat Openshift Data Foundation 4.18 1786705347, 1786705558, 1786705646, 1786705741, 1786705777, 1786705802, 1786705938, 1786706101, 1786706125, 1786706138, 1786706177, 1786706188, 1786706357, 1786706577, 1786706612, 1786706644, 1786706659, 1786706679, 1786706880
  • Red Hat Red Hat Openshift Data Foundation 4.19 1786701555, 1786701839, 1786702052, 1786702264, 1786702276, 1786702315, 1786702440, 1786702448, 1786702559, 1786702563, 1786702623, 1786702636, 1786702713, 1786702716, 1786702872, 1786702917, 1786702949, 1786703071, 1786703137, 1786703143
  • Red Hat Red Hat Openshift Data Foundation 4.20 1786626399, 1786627106, 1786627382, 1786627430, 1786627460, 1786627469, 1786627559, 1786628053, 1786628142, 1786628235, 1786628340, 1786628623, 1786629076, 1786629478, 1786629761, 1786631508, 1786632256, 1786644072, 1786687918, 1786688215
  • Red Hat Red Hat OpenShift Dev Spaces 3.29 1782498792, 1782989367, 1783007534, 1785245777
  • Red Hat Red Hat OpenShift Dev Spaces 3.30 1787759145, 1787759723, 1787760821
  • node-undici Debian 14 8.5.0+dfsg+~cs3.2.0-1

debian advisories DEBIAN-CVE-2026-12151

  • npm RHEL 8 1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
  • nodejs RHEL 8 1:22.23.1-1.module+el8.10.0+24500+8eb51621
  • nodejs-libs RHEL 8 1:22.23.1-1.module+el8.10.0+24500+8eb51621
  • nodejs-nodemon RHEL 8 3.0.1-1.module+el8.10.0+24500+8eb51621
  • nodejs-full-i18n RHEL 8 1:22.23.1-1.module+el8.10.0+24500+8eb51621
  • nodejs-packaging RHEL 8 2021.06-6.module+el8.10.0+24500+8eb51621
  • nodejs-packaging-bundler RHEL 8 2021.06-6.module+el8.10.0+24500+8eb51621
  • npm RHEL 8 1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8

red hat advisories RHSA-2026:52399RHSA-2026:41947RHSA-2026:39868RHSA-2026:39246RHSA-2026:38236RHSA-2026:38009

  • nodejs16 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 16.20.2-150400.3.42.1
  • nodejs18 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 18.20.8-150400.9.39.1
  • nodejs20 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 20.20.2-150500.11.30.1
  • nodejs24 SLES for SAP applications 16.0, SLES 16.0 24.18.0-160000.1.1
  • nodejs22 SLE Module for Web and Scripting 15 SP7 22.23.0-150700.3.12.1
  • nodejs24 SLE Module for Web and Scripting 15 SP7 24.17.0-150700.15.11.1
  • nodejs22 SLES for SAP applications 16.0, SLES 16.0 22.23.0-160000.1.1
  • nodejs18 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 18.20.8-8.44.1

suse advisories SUSE-SU-2026:4355-1SUSE-SU-2026:4261-1SUSE-SU-2026:4248-1SUSE-SU-2026:3930-1SUSE-SU-2026:3929-1SUSE-SU-2026:22565-1

  • nodejs24 openSUSE Leap 16.0 24.18.0-160000.1.1
  • nodejs22 openSUSE Leap 16.0 22.23.0-160000.1.1
  • nodejs24 openSUSE Tumbleweed 24.17.0-1.1

opensuse advisories openSUSE-SU-2026:21236-1openSUSE-SU-2026:21058-1openSUSE-SU-2026:11121-1

  • npm AlmaLinux 8 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
  • nodejs AlmaLinux 8 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
  • nodejs-libs AlmaLinux 8 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
  • nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.10.0+3956+47c9ee9f
  • nodejs-full-i18n AlmaLinux 8 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4158+e796f37f
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4158+e796f37f
  • npm AlmaLinux 8 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94

almalinux advisories ALSA-2026:41947ALSA-2026:39868ALSA-2026:35841ALSA-2026:35842ALSA-2026:35891ALSA-2026:35892

  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.9.0+1760+903d54b9
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1667+4a788d89
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1824+532140ee
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1823+b5789597
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1924+614dc87f
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1666+930e28e8
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1988+437f3d23
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1989+e60144d9

rocky linux advisories RLSA-2026:41947RLSA-2026:39868RLSA-2026:35841RLSA-2026:35842RLSA-2026:35891RLSA-2026:35892

  • nodejs Azure Linux 3.0 24.18.1-1

azure linux advisories AZL-91191

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12151 updated cvss 7.5

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git
    affected: workaround, no fix available
  • Red Hat Hardened Images nodejs25
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal, ansible-automation-platform/bootc-automation-portal-rhel9
    affected: workaround, no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-rhel9 1782841925, cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1782844225, cluster-observability-operator/monitoring-console-plugin-pf6-rhel9 1782839658, +6 more
    fixed: vendor fix RHSA-2026:34342
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-13
    fixed: vendor fix RHSA-2026:48151
  • Red Hat AMQ Broker 7.13.6
    fixed: vendor fix RHSA-2026:66545
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1784210921
    fixed: vendor fix RHSA-2026:41929
show 24 more
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1783448184
    fixed: vendor fix RHSA-2026:36754
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 22.23.1-1.module+el8.10.0+24500+8eb51621, nodejs 24.18.0-1.module+el8.10.0+24481+7a71fac8, nodejs-libs 22.23.1-1.module+el8.10.0+24500+8eb51621, nodejs-libs 24.18.0-1.module+el8.10.0+24481+7a71fac8, nodejs-nodemon 3.0.1-1.module+el8.10.0+24500+8eb51621, nodejs-nodemon 3.0.3-1.module+el8.10.0+24190+49a46c75, +8 more
    fixed: vendor fix RHSA-2026:41947
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.23.1-1.module+el9.8.0+24457+996af7aa, nodejs 24.18.0-1.module+el9.8.0+24456+b244c3b4, nodejs-libs 22.23.1-1.module+el9.8.0+24457+996af7aa, nodejs-libs 24.18.0-1.module+el9.8.0+24456+b244c3b4, nodejs-nodemon 3.0.1-1.module+el9.8.0+24156+bb41d456, nodejs-nodemon 3.0.3-3.module+el9.8.0+24355+35d95b59, +8 more
    fixed: vendor fix RHSA-2026:35892
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.23.1-2.el10_2, nodejs22 22.23.1-2.el10_2, nodejs24 24.18.0-1.el10_2, nodejs-libs 22.23.1-2.el10_2, nodejs24-libs 24.18.0-1.el10_2, nodejs-full-i18n 22.23.1-2.el10_2, +3 more
    fixed: vendor fix RHSA-2026:35842
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.23.1-2.el10_0, nodejs22 22.23.1-2.el10_0, nodejs-libs 22.23.1-2.el10_0, nodejs-full-i18n 22.23.1-2.el10_0, nodejs-npm 10.9.8-1.22.23.1.2.el10_0
    fixed: vendor fix RHSA-2026:39246
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 22.23.1-2.module+el9.6.0+24604+449f851b, nodejs-libs 22.23.1-2.module+el9.6.0+24604+449f851b, npm 10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b, nodejs-nodemon 3.1.14-1.module+el9.6.0+24604+449f851b, nodejs-full-i18n 22.23.1-2.module+el9.6.0+24604+449f851b, nodejs-packaging 2021.06-4.module+el9.6.0+23473+45664c2d, +1 more
    fixed: vendor fix RHSA-2026:52399
  • Red Hat Hardened Images nodejs26 26.5.0-1.3.hum1, nodejs24 24.18.0-0.3.hum1, nodejs26-bin 26.5.0-1.3.hum1, nodejs24-bin 24.18.0-0.3.hum1, nodejs26-libs 26.5.0-1.3.hum1, nodejs24-libs 24.18.0-0.3.hum1, +6 more
    fixed: vendor fix RHSA-2026:38236
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-mod-arch-model-registry-rhel9 1791853432, rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787801527
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.3 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1790013905
    fixed: vendor fix RHSA-2026:73987
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1791861020, rhoai/odh-mod-arch-maas-rhel9 1791860708, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1791861479, rhoai/odh-mod-arch-autorag-rhel9 1791860994, rhoai/odh-mod-arch-eval-hub-rhel9 1791861214, +2 more
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-monitoring-plugin-rhel9 1783306396
    fixed: vendor fix RHSA-2026:36621
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-monitoring-plugin-rhel9 1784744859
    fixed: vendor fix RHSA-2026:47728
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1786701839, odf4/odf-cli-rhel9 1786702440, odf4/mcg-core-rhel9 1786702052, odf4/odf-console-rhel9 1786703071, odf4/mcg-rhel9-operator 1786702559, odf4/ocs-rhel9-operator 1786702276, +14 more
    fixed: vendor fix RHSA-2026:56366
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1786627460, odf4/odf-cli-rhel9 1786628142, odf4/mcg-core-rhel9 1786628235, odf4/odf-console-rhel9 1786628053, odf4/mcg-rhel9-operator 1786627106, odf4/ocs-rhel9-operator 1786629478, +16 more
    fixed: vendor fix RHSA-2026:57013
  • Red Hat OpenShift Dev Spaces 3.29 devspaces/code-rhel9 1785245777, devspaces/openvsx-rhel9 1783007534, devspaces/dashboard-rhel9 1782498792, devspaces/pluginregistry-rhel9 1782989367
    fixed: vendor fix RHSA-2026:48124
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1787759145, devspaces/dashboard-rhel9 1787760821, devspaces/pluginregistry-rhel9 1787759723
    fixed: vendor fix RHSA-2026:62260
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1782839109, cluster-observability-operator/thanos-rhel9 1782840280, cluster-observability-operator/korrel8r-rhel9 1782839157, cluster-observability-operator/prometheus-rhel9 1782840780, cluster-observability-operator/alertmanager-rhel9 1782840761, cluster-observability-operator/perses-rhel9-operator 1782839191, +7 more
    not affected: vulnerable code not present
  • Red Hat Cryostat 4 undici, cryostat-openshift-console-plugin-npm
    not affected: component not present
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-13, cryostat/cryostat-db-rhel9 4.2.0-19, cryostat/jfr-datasource-rhel9 4.2.0-13, cryostat/cryostat-reports-rhel9 4.2.0-13, cryostat/cryostat-storage-rhel9 4.2.0-19, cryostat/cryostat-rhel9-operator 4.2.0-18, +3 more Red Hat Developer Hub 1.9 rhdh/rhdh-rhel9-operator 1784210575, rhdh/rhdh-operator-bundle 1784215493 Red Hat Developer Hub 1.10 rhdh/rhdh-rhel9-operator 1783447707, rhdh/rhdh-operator-bundle 1783453583, rhdh/rhdh-must-gather-rhel9 1783447888, rhdh/rhdh-rag-content-rhel9 1783446803 Red Hat Hardened Images rust
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-mlflow-rhel9
    not affected: component not present
  • Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1788331391, rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-modelmesh-rhel9 1788319539, +140 more Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1790070206, rhoai/rhai-cli-rhel9 1790070206, rhoai/odh-mlflow-rhel9 1789653606, rhoai/odh-trainer-rhel9 1790136369, rhoai/odh-maas-api-rhel9 1790131842, rhoai/odh-mlserver-rhel9 1789121365, +76 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-automl-rhel9 1791535789, +198 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console-rhel9, openshift4/ose-agent-installer-ui-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1782903662, openshift4/ose-pod-rhel9 1782908063, openshift4/ose-sdn-rhel9 1782908221, openshift4/ose-etcd-rhel9 1782907163, openshift4/ose-tests-rhel9 1782935874, openshift4/ose-tools-rhel9 1782934158, +182 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1784323435, openshift4/ose-cli-rhel9 1784327350, openshift4/ose-pod-rhel9 1784317566, openshift4/ose-etcd-rhel9 1784313998, openshift4/ose-tests-rhel9 1784717215, openshift4/ose-tools-rhel9 1784715500, +182 more Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-agent-installer-ui-rhel9
    not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm undici
<6.27.0
>=7.0.0, <7.28.0
>=8.0.0, <8.5.0
6.27.0
7.28.0
8.5.0

Affected products

  • undici undici
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Red Hat Developer Hub 1.10
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat OpenShift Dev Spaces 3.29
  • Red Hat Red Hat OpenShift Dev Spaces 3.30
  • Red Hat Cryostat 4
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Build of Podman Desktop
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Self-service automation portal 2

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.