CVE-2026-12151— undici WebSocket client vulnerable to denial of service via fragment count bypass
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12151
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
undici WebSocket client vulnerable to denial of service via fragment count bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-12151
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12151
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12151 (1)
Same Patch Batch · undici · 2026-06-17 · 8 CVEs total
| CVE-2026-9675 | 7.5 HIGH | undici WebSocket client vulnerable to denial of service via cumulative fragment bypass |
| CVE-2026-6734 | 7.5 HIGH | undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
| CVE-2026-9697 | 7.4 HIGH | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 Pr |
| CVE-2026-9679 | 5.9 MEDIUM | undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
| CVE-2026-9678 | 5.9 MEDIUM | undici vulnerable to cross-user information disclosure via shared cache whitespace bypass |
| CVE-2026-6733 | 3.7 LOW | undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
| CVE-2026-11525 | 3.7 LOW | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matc |
IV. Related Vulnerabilities
Same product: undici
- CVE-2026-11525
undici vulnerable to Set-Cookie SameSite attribute downgrade - CVE-2026-6733
undici vulnerable to HTTP response queue poisoning via keep- - CVE-2026-9678
undici vulnerable to cross-user information disclosure via s - CVE-2026-9679
undici vulnerable to HTTP header injection via Set-Cookie pe - CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via d
Same vendor: undici
- CVE-2026-11525
undici vulnerable to Set-Cookie SameSite attribute downgrade - CVE-2026-6733
undici vulnerable to HTTP response queue poisoning via keep- - CVE-2026-9678
undici vulnerable to cross-user information disclosure via s - CVE-2026-9679
undici vulnerable to HTTP header injection via Set-Cookie pe - CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via d
Same weakness: CWE-400
- CVE-2026-9375
Decompression Bomb Bypass via Negative max_length in Streami - CVE-2026-49293
CPU exhaustion via O(n^2) BigInt construction on radix-prefi - CVE-2026-48937
Node.js 22/24 HTTP/2服务器GoAway帧后持续接收数据漏洞 - CVE-2025-53114
CometD has acknowledgement extension out of memory - CVE-2025-32437
AutoGPT has a DoS vulnerability in MediaDurationBlock
V. Comments for CVE-2026-12151
No comments yet