CVE-2026-9675: Undici WebSocket Memory Exhaustion Denial of Service

Technical summary

The undici WebSocket implementation enforces maxPayloadSize as a per-frame limit but fails to validate the cumulative payload size of fragmented uncompressed messages. An attacker operating a WebSocket server can transmit many small frames that individually satisfy the maxPayloadSize constraint. When reassembled, these fragments bypass the cumulative size check entirely, leading to unbounded memory allocation in the client process. The vulnerability stems from a regression introduced in version 8.1.0; earlier versions in the 6.25.0 line implemented cumulative validation correctly from the start, and the 7.x line never included maxPayloadSize enforcement, making them unaffected. The issue is triggered when a vulnerable client initiates a WebSocket connection to an attacker-controlled endpoint.

Business impact

Memory exhaustion denial-of-service attacks can render services unavailable, trigger unexpected restarts, and degrade user experience. Organizations relying on undici 8.1.x for WebSocket communication risk operational disruption if clients connect to compromised endpoints or if network paths allow server spoofing. The impact scope is limited to applications that explicitly use WebSocket connections; services using undici only for HTTP operations are not affected. Attackers require network-level access to the target server (either by controlling it or by compromise), moderating the threat surface but not eliminating it in scenarios involving untrusted WebSocket peers.

Affected systems

The vulnerability affects Node.js applications using undici versions 8.1.0 through 8.4.0 that instantiate WebSocket clients via the new WebSocket(...) constructor. Organizations should inventory dependencies on undici and determine which versions are deployed. Versions 6.25.0 and later in the 6.x line are unaffected; all 7.x versions are unaffected; and 8.5.0 and later include the fix. Development, staging, and production environments should all be assessed, as an attacker may target staging systems to probe for vulnerable configurations before attempting production exploitation.

Exploitability

Exploitation requires network access to the target WebSocket client and the ability to host or compromise a WebSocket server to which the client will connect. The attack vector is network-based with no authentication or user interaction required once the client connects. However, real-world impact depends on whether applications connect to untrusted or dynamically determined endpoints. Applications that only connect to well-known, internal WebSocket servers have lower exposure. Public-facing services that accept user-supplied WebSocket URLs, or systems that connect to third-party services without strict validation, face higher risk. The attack is reliable and deterministic—no race conditions or specific timing required.

Remediation

Upgrade undici to version 8.5.0 or later. This fix restores proper cumulative payload validation for fragmented WebSocket messages. No configuration changes or workarounds are available; patching is mandatory. Organizations should prioritize patching based on deployment risk: applications accepting arbitrary WebSocket URLs should be patched first, followed by those with any external WebSocket connections, and finally those restricted to internal endpoints. Coordinate patching with any CI/CD pipeline updates to ensure lockfiles and dependency manifests are updated.

Patch guidance

Update the undici dependency to >= 8.5.0. In npm/yarn projects, run 'npm update undici' or update package.json to specify '^8.5.0' or '~8.5.0' and reinstall dependencies. Verify the installed version matches the requirement using 'npm list undici'. For Node.js projects, confirm that the patched version is transitively included if undici is a sub-dependency of other packages. Test WebSocket functionality in a pre-production environment before deploying to production to ensure compatibility and catch any unexpected behavior.

Detection guidance

Monitor Node.js process memory usage, especially for applications known to use undici WebSocket clients. A sudden spike in resident memory without corresponding request volume growth may indicate a fragmentation attack. Inspect WebSocket traffic logs or network monitoring for unusual patterns: many small frames from a single server or peer that exceed normal payload volumes when aggregated. If WebSocket servers are under your control, review access logs for suspicious connection patterns or frame sequences designed to trigger memory exhaustion. Consider implementing memory limits at the OS or container level as a safety net while patching is in progress.

Why prioritize this

This vulnerability merits rapid patching due to its ease of exploitation, high reliability, and denial-of-service impact. The CVSS score of 7.5 (HIGH) reflects the availability impact and network attack vector. Unlike many high-severity flaws, this one requires only that a vulnerable client connect to a compromised or attacker-controlled server—no client-side vulnerability in parsing untrusted input is required. The affected version range is narrow (8.1.0–8.4.0), making scope assessment straightforward. Patches are available and do not introduce breaking changes, removing excuses for delay.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is calculated as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The network attack vector (AV:N) and low complexity (AC:L) reflect that exploitation requires only network access and a successful connection, not complex interaction. The absence of confidentiality or integrity impact (C:N, I:N) is correct—the attack causes denial of service through resource exhaustion, not data theft or corruption. The high availability impact (A:H) correctly represents the certain memory exhaustion and process crash. The score does not account for the narrow version range or low likelihood of connections to untrusted servers in many deployments; organizations with restricted WebSocket connectivity should assess their own risk lower than the baseline score.

Frequently asked questions