LiveActive security incident?Get immediate response
CVE Record

CVE-2026-1526: undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-1526 can crash Node.js processes that use undici as a WebSocket client. If the client accepts compressed WebSocket messages from a malicious or compromised server, a small message can expand heavily in memory and exhaust the process. The impact is availability loss, not data theft or code execution based on the provided sources.

Executive priority

Prioritize remediation for internet-facing or automation-heavy systems that connect to external WebSocket services. The business risk is service disruption from process crashes, especially where a single Node.js process handles important workflows or availability commitments.

Technical view

The issue is in undici WebSocket permessage-deflate decompression. PerMessageDeflate.decompress() accumulates decompressed chunks and concatenates them without enforcing a decompressed-size limit. A remote server can trigger unbounded memory consumption after permessage-deflate negotiation. CVSS is 7.5 high: network reachable, low complexity, no privileges, no user interaction, availability-only impact.

Likely exposure

Exposure is most likely in Node.js services, CLIs, agents, or integrations using affected undici versions as WebSocket clients to connect to untrusted, user-controlled, third-party, or compromised servers with permessage-deflate enabled.

Exploitation context

The bundle does not show active exploitation, and KEV is false. Exploitation requires a malicious WebSocket server or a compromised upstream endpoint that can negotiate permessage-deflate and send compressed frames that decompress far beyond expected size.

Researcher notes

Focus triage on client-side WebSocket usage, not generic HTTP usage alone. The vulnerable condition depends on permessage-deflate negotiation and unbounded decompressed output. Evidence supports denial of service only; the provided sources do not support confidentiality, integrity, or code execution claims.

Mitigation direction

  • Upgrade undici to 6.24.0, 7.24.0, or later fixed vendor packages.
  • Apply relevant Red Hat advisories where undici is supplied through Red Hat products.
  • Review vendor guidance before relying on configuration-only workarounds.
  • Restrict outbound WebSocket clients to trusted endpoints where feasible.
  • Monitor Node.js process memory and restart behavior during remediation.

Validation and detection

  • Inventory package-lock, pnpm-lock, yarn.lock, and SBOMs for undici versions.
  • Identify code paths using undici WebSocket client functionality.
  • Confirm whether WebSocket connections can negotiate permessage-deflate.
  • Check container, OS, and Red Hat package advisories for bundled undici exposure.
  • Verify upgraded deployments no longer include vulnerable undici ranges.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-409: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-1526 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
23Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6openjs
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-1526Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPundici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression
other:Red Hat severity ratingcvssV3_1
  • 2026-03-12T21:01:25.538Z: Reported to Red Hat.
  • 2026-03-12T20:08:05.950Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
undiciundiciundici, < 6.24.0; 7.0.0 < 7.24.0, 6.24.0: 7.24.0unaffected
Weakness

CWE details

CWE-409CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-409 · source CWE mapping

Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data (Data Amplification) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-770 · source CWE mapping

Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs