Skip to content
Fencer Vulns
high 7.5

CVE-2026-1526 json

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

published 2026-03-12 7 mo ago modified 2026-09-14 56 d ago also GHSA-vrm6-8vpv-qv8q , EUVD-2026-11699

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.

The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Patch / fix

  • npm undici 6.24.0, 7.24.0
  • undici undici 6.24.0: 7.24.0
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-9
  • Red Hat Red Hat Enterprise Linux 10 1:22.22.2-1.el10_1, 1:24.14.1-2.el10_1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 1:22.22.2-2.el10_0
  • Red Hat Red Hat Enterprise Linux 8 8100020260331102257.6d880403, 8100020260408131901.6d880403
  • Red Hat Red Hat Enterprise Linux 9 9070020260401095228.rhel9, 9070020260402152654.rhel9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260409121057.rhel9
  • Red Hat Cluster Observability Operator 1.5.0 1782839279, 1782839996, 1782840539
  • Red Hat Red Hat Developer Hub 1.8 1776784286
  • Red Hat Red Hat Developer Hub 1.9 1777903262
  • Red Hat Red Hat OpenShift AI 2.16 1774282136
  • Red Hat Red Hat Openshift Data Foundation 4.18 1786705347, 1786705558, 1786705646, 1786705741, 1786705777, 1786705802, 1786705938, 1786706101, 1786706125, 1786706138, 1786706177, 1786706188, 1786706357, 1786706577, 1786706612, 1786706644, 1786706659, 1786706679, 1786706880
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1779814592
  • Red Hat Red Hat OpenShift Pipelines 1.2 1779910201
  • node-undici Debian 14 7.24.5+dfsg+~cs3.2.0-1

debian advisories DEBIAN-CVE-2026-1526

  • nodejs24 RHEL 10.1 1:24.14.1-2.el10_1
  • nodejs24-npm RHEL 10.1 1:11.11.0-1.24.14.1.2.el10_1
  • nodejs24-libs RHEL 10.1 1:24.14.1-2.el10_1
  • nodejs24-full-i18n RHEL 10.1 1:24.14.1-2.el10_1
  • npm RHEL 8 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
  • nodejs RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75
  • nodejs-libs RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75
  • nodejs-nodemon RHEL 8 3.0.3-1.module+el8.10.0+24190+49a46c75

red hat advisories RHSA-2026:7983RHSA-2026:7675RHSA-2026:7670RHSA-2026:7350RHSA-2026:7310RHSA-2026:7302

  • npm AlmaLinux 8 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
  • nodejs AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-libs AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-nodemon AlmaLinux 8 3.0.3-1.module_el8.10.0+4061+f8ceeab9
  • nodejs-full-i18n AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs24-npm AlmaLinux 10 1:11.11.0-1.24.14.1.2.el10_1

almalinux advisories ALSA-2026:7670ALSA-2026:7675ALSA-2026:7350ALSA-2026:7123

  • nodejs24 Rocky Linux 10 1:24.14.1-2.el10_1
  • nodejs-nodemon Rocky Linux 8 3.0.3-1.module+el8.10.0+2084+ab509703
  • nodejs-packaging Rocky Linux 8 2021.06-6.module+el8.10.0+40048+6d99f608
  • nodejs22 Rocky Linux 10 1:22.22.2-1.el10_1
  • nodejs-nodemon Rocky Linux 9 3.0.3-3.module+el9.7.0+40025+0e0cf6b2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40017+f0db1785
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40018+a011993d

rocky linux advisories RLSA-2026:7675RLSA-2026:7670RLSA-2026:7080RLSA-2026:7350RLSA-2026:7302RLSA-2026:7123

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-1526 updated cvss 7.5

undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression

  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8
    affected: workaround, no fix available
  • Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/openvsx-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9 1782839996
    fixed: vendor fix RHSA-2026:34342
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-9, cryostat/cryostat-openshift-console-plugin-rhel9 4.2.0-9
    fixed: vendor fix RHSA-2026:17789
  • Red Hat Developer Hub 1.8 rhdh 1776784286
    fixed: vendor fix RHSA-2026:9742
  • Red Hat Developer Hub 1.9 rhdh 1777903262
    fixed: vendor fix RHSA-2026:13826
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-libs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs-libs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-nodemon 3.0.1-1.module+el8.10.0+24148+847b6786, nodejs-nodemon 3.0.3-1.module+el8.10.0+24190+49a46c75, +8 more
    fixed: vendor fix RHSA-2026:7123
show 14 more
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-libs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs-libs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-nodemon 3.0.1-1.module+el9.7.0+24157+8ddb2461, nodejs-nodemon 3.0.3-3.module+el9.7.0+24166+51c9666b, +8 more
    fixed: vendor fix RHSA-2026:7302
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.22.2-1.el10_1, nodejs22 22.22.2-1.el10_1, nodejs24 24.14.1-2.el10_1, nodejs-libs 22.22.2-1.el10_1, nodejs24-libs 24.14.1-2.el10_1, nodejs-full-i18n 22.22.2-1.el10_1, +3 more
    fixed: vendor fix RHSA-2026:7080
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.22.2-2.el10_0, nodejs22 22.22.2-2.el10_0, nodejs-libs 22.22.2-2.el10_0, nodejs-full-i18n 22.22.2-2.el10_0, nodejs-npm 10.9.7-1.22.22.2.2.el10_0
    fixed: vendor fix RHSA-2026:7310
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-libs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-nodemon 3.0.1-1.module+el9.6.0+23473+45664c2d, npm 10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e, nodejs-full-i18n 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-packaging 2021.06-4.module+el9.6.0+23473+45664c2d, +1 more
    fixed: vendor fix RHSA-2026:7983
  • Red Hat OpenShift AI 2.16 rhoai 1774282136
    fixed: vendor fix RHSA-2026:5807
  • Red Hat OpenShift AI 3.3 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1790013905
    fixed: vendor fix RHSA-2026:73987
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/code-rhel9 1779814592
    fixed: vendor fix RHSA-2026:21772
  • Red Hat OpenShift Pipelines 1.20 openshift-pipelines/pipelines-console-plugin-rhel9 1779910201
    fixed: vendor fix RHSA-2026:21931
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1782839109, cluster-observability-operator/thanos-rhel9 1782840280, cluster-observability-operator/korrel8r-rhel9 1782839157, cluster-observability-operator/prometheus-rhel9 1782840780, cluster-observability-operator/alertmanager-rhel9 1782840761, cluster-observability-operator/perses-rhel9-operator 1782839191, +16 more Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-db-rhel9 4.2.0-13, cryostat/jfr-datasource-rhel9 4.2.0-9, cryostat/cryostat-reports-rhel9 4.2.0-9, cryostat/cryostat-storage-rhel9 4.2.0-13, cryostat/cryostat-operator-bundle 4.2.0-7, cryostat/cryostat-rhel9-operator 4.2.0-13, +2 more Red Hat Developer Hub 1.8 rhdh 1776783947, rhdh 1776787729 Red Hat Developer Hub 1.9 rhdh 1777902709, rhdh 1777909942 Red Hat JBoss Enterprise Application Platform 8 org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform Expansion Pack org.keycloak-keycloak-parent
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9, +11 more
    not affected: component not present
  • Red Hat OpenShift AI 2.16 rhoai 1774282058, rhoai 1774282073, rhoai 1774282078, rhoai 1774282087, rhoai 1774282092, rhoai 1774282093, +19 more Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1790070206, rhoai/rhai-cli-rhel9 1790070206, rhoai/odh-mlflow-rhel9 1789653606, rhoai/odh-trainer-rhel9 1790136369, rhoai/odh-maas-api-rhel9 1790131842, rhoai/odh-mlserver-rhel9 1789121365, +76 more Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1786708633, odf4/ocs-operator-bundle 1786708778, odf4/odf-operator-bundle 1786709119, odf4/cephcsi-operator-bundle 1786708508, odf4/odr-hub-operator-bundle 1786709184, odf4/rook-ceph-operator-bundle 1786709254, +7 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Dev Spaces devspaces/code-sshd-rhel9
    not affected: component not present
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/udi-rhel9 1779829736, devspaces/server-rhel9 1779342423, devspaces/openvsx-rhel9 1779528224, devspaces/traefik-rhel9 1779786779, devspaces/udi-base-rhel9 1779741066, devspaces/code-sshd-rhel9 1779813519, +9 more Red Hat OpenShift Pipelines 1.20 openshift-pipelines/pipelines-nop-rhel9 1779824303, openshift-pipelines/pipelines-opc-rhel9 1779509912, openshift-pipelines/pipelines-cache-rhel9 1779781652, openshift-pipelines/pipelines-events-rhel9 1779824120, openshift-pipelines/pipelines-hub-ui-rhel9 1779912885, openshift-pipelines/pipelines-cli-tkn-rhel9 1779257473, +28 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm undici
<6.24.0
>=7.0.0, <7.24.0
6.24.0
7.24.0

Affected products

  • undici undici
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat OpenShift AI 2.16
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Red Hat OpenShift Pipelines 1.2
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Developer Hub
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Self-service automation portal 2

Classification

Weakness
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.