CVE-2026-1528— undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-1528
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
Source: NVD (National Vulnerability Database)
Vulnerability Description
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
未捕获的异常
Source: NVD (National Vulnerability Database)
Vulnerability Title
undici 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
undici是Node.js开源的一个HTTP/1.1客户端。 undici存在安全漏洞，该漏洞源于ByteParser在处理使用64位长度格式且长度极大的WebSocket帧时内部数学运算溢出，可能导致进程因致命TypeError而终止。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-1528
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-1528
请登录查看更多情报信息。
Same Patch Batch · undici · 2026-03-12 · 6 CVEs total
| CVE-2026-1526 | 7.5 HIGH | undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflat |
| CVE-2026-2229 | 7.5 HIGH | undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid serv |
| CVE-2026-1525 | 6.5 MEDIUM | undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Respon |
| CVE-2026-2581 | 5.9 MEDIUM | undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler v |
| CVE-2026-1527 | 4.6 MEDIUM | undici is vulnerable to CRLF Injection via upgrade option |
IV. Related Vulnerabilities
Same product: undici
- CVE-2026-2229
undici is vulnerable to Unhandled Exception in undici WebSoc - CVE-2026-1527
undici is vulnerable to CRLF Injection via upgrade option - CVE-2026-2581
undici is vulnerable to Unbounded Memory Consumption in in U - CVE-2026-1526
undici is vulnerable to Unbounded Memory Consumption in undi - CVE-2026-1525
undici is vulnerable to Inconsistent Interpretation of HTTP
Same vendor: undici
- CVE-2026-2229
undici is vulnerable to Unhandled Exception in undici WebSoc - CVE-2026-1527
undici is vulnerable to CRLF Injection via upgrade option - CVE-2026-2581
undici is vulnerable to Unbounded Memory Consumption in in U - CVE-2026-1526
undici is vulnerable to Unbounded Memory Consumption in undi - CVE-2026-1525
undici is vulnerable to Inconsistent Interpretation of HTTP
Same weakness: CWE-248
- CVE-2026-41585
ZEBRA: Denial of Service via Interrupted JSON-RPC Requests f - CVE-2026-7183
aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp De - CVE-2026-5937
Foxit PDF Editor/Reader's insufficient parameter validation - CVE-2026-35348
uutils coreutils sort Local Denial of Service via Forced UTF - CVE-2026-34944
Wasmtime segfault or unused out-of-sandbox load with `f64x2.
V. Comments for CVE-2026-1528
No comments yet