En bref
- CVE-2026-1528 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant undici (nodejs), undici.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.51%, plus élevée que 43.4% des vulnérabilités.
- Correctif : mettre à jour vers 7.24.0, 6.24.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| undici | ≥ 7.0.0, < 7.24.0< 6.24.0
| 7.24.06.24.0
|
| undici npm | ≥ 6.0.0, < 6.24.0≥ 7.0.0, < 7.24.0
| 6.24.07.24.0
|
Description
Impact
A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Workarounds
There are no workarounds.
NVD description
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free