CVE-2026-12151: undici WebSocket Memory Exhaustion DoS Vulnerability

Technical summary

CVE-2026-12151 is a resource exhaustion vulnerability in undici's WebSocket implementation. The client correctly validates maxPayloadSize against the cumulative byte count of fragments within a single message, but fails to enforce a per-message limit on the number of fragments itself. A malicious server can exploit this by sending continuation frames with minimal or zero-length payloads; each frame passes validation independently, but their aggregate causes unbounded growth of internal data structures tracking message state. This leads to memory exhaustion without triggering payload-size checks. The vulnerability affects all versions from 6.17.0 onward until patched. The weakness is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling).

Business impact

Applications relying on undici for WebSocket communication—particularly those connecting to third-party or user-supplied WebSocket endpoints—face availability risk. A denial-of-service attack via resource exhaustion could crash critical services, disrupt real-time communication features (chat, notifications, live data streams), or trigger cascading failures in microservice architectures. In cloud environments, repeated attacks could inflate infrastructure costs through aggressive auto-scaling. The impact is amplified for always-on services that must maintain WebSocket connections to external or less-trusted providers.

Affected systems

The vulnerability affects Node.js applications using undici versions 6.17.0 through 6.25.x, 7.0.0 through 7.27.x, and 8.0.0 through 8.4.x. Any code instantiating a WebSocket client via undici's `new WebSocket(...)` constructor or using the WebSocketStream API is vulnerable. This includes both direct usage and indirect dependency through frameworks or libraries that embed undici. Notably, undici is a core component of Node.js's native fetch and WebSocket support in recent versions, making exposure potentially widespread.

Exploitability

Exploitation requires only network-level control: the attacker must convince or trick the victim application into connecting to a malicious WebSocket server, or compromise an existing trusted endpoint. No authentication or elevated privileges are needed. The attack is trivial to execute—sending small continuation frames in rapid succession—and requires no special tools or exploit code. The barrier to exploitation is low, especially for applications that connect to external services based on user input or configuration.

Remediation

Upgrade undici immediately to version 6.26.0 or later, 7.28.0 or later, or 8.5.0 or later. No interim workaround exists; patching is mandatory. Organizations should prioritize this upgrade for any production systems handling WebSocket connections. For applications unable to update immediately, restrict network connectivity to WebSocket endpoints under trusted administrative control only.

Patch guidance

Apply one of the following patched versions depending on your current baseline: undici >= 6.26.0 (for the 6.x line), >= 7.28.0 (for the 7.x line), or >= 8.5.0 (for the 8.x line). Use your package manager (npm, yarn, pnpm) to upgrade: `npm update undici` or manually specify the minimum version in package.json and reinstall. Test in a staging environment to ensure compatibility with your application's WebSocket usage patterns. If undici is a transitive dependency, verify that dependent packages are compatible with the patched version before deploying to production.

Detection guidance

Monitor for unexpected spikes in memory consumption in Node.js processes using WebSocket clients, particularly following connections to external or user-supplied endpoints. Log WebSocket connection attempts and their sources; correlate memory exhaustion incidents with new or suspicious server connections. Implement resource limits (e.g., memory caps via cgroups or container orchestration) to prevent a single process from consuming excessive system resources. Consider using APM or memory profiling tools to detect unusual fragment accumulation patterns. Network-level IDS rules could flag servers sending excessive continuation frames, though this may generate false positives in legitimate high-frequency streaming scenarios.

Why prioritize this

This vulnerability merits immediate attention despite lacking CISA KEV status. It combines a network-accessible attack vector, trivial exploitability, and direct denial-of-service impact with a CVSS score of 7.5 (HIGH). The widespread adoption of undici in Node.js ecosystems—including as a built-in component—amplifies blast radius. Applications accepting WebSocket connections from external or semi-trusted sources face elevated risk and should patch first. Even internal-only deployments should be prioritized if network boundaries cannot be absolutely guaranteed.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), no privilege or user interaction requirements (PR:N/UI:N), and a direct availability impact through denial of service (A:H). Confidentiality and integrity are unaffected (C:N/I:N). The score appropriately captures the threat level for services exposed to untrusted WebSocket peers. Organizations with strict perimeter controls limiting WebSocket connections to internal or administratively controlled servers may assess lower practical risk, but should not rely on this assumption without explicit validation.

Frequently asked questions