High severity7.5NVD Advisory· Published Jun 17, 2026· Updated Sep 11, 2026
CVE-2026-12151
CVE-2026-12151
Description
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
undicinpm | < 6.27.0 | 6.27.0 |
undicinpm | >= 7.0.0, < 7.28.0 | 7.28.0 |
undicinpm | >= 8.0.0, < 8.5.0 | 8.5.0 |
Affected products
56- osv-coords54 versionspkg:apk/chainguard/actions-runnerpkg:apk/chainguard/code-serverpkg:apk/chainguard/gemini-clipkg:apk/chainguard/harakapkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/node-gyppkg:apk/chainguard/npmpkg:apk/chainguard/pelias-apipkg:apk/chainguard/prismpkg:apk/chainguard/py3.10-captumpkg:apk/chainguard/py3.11-captumpkg:apk/chainguard/py3.12-captumpkg:apk/chainguard/py3.13-captumpkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/vitess-24pkg:apk/wolfi/code-serverpkg:apk/wolfi/node-gyppkg:apk/wolfi/npmpkg:apk/wolfi/prismpkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/vitess-24pkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-develpkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweed
< 2.335.1-r1+ 53 more
- (no CPE)range: < 2.335.1-r1
- (no CPE)range: < 4.125.0-r2
- (no CPE)range: < 0.49.0-r4
- (no CPE)range: < 3.3.1-r1
- (no CPE)range: < 8.19.16-r6
- (no CPE)range: < 8.19.16-r6
- (no CPE)range: < 8.19.16-r6
- (no CPE)range: < 9.1.10-r21
- (no CPE)range: < 9.1.10-r21
- (no CPE)range: < 9.2.8-r9
- (no CPE)range: < 9.2.8-r9
- (no CPE)range: < 9.3.5-r4
- (no CPE)range: < 9.3.5-r4
- (no CPE)range: < 9.4.2-r5
- (no CPE)range: < 9.4.2-r5
- (no CPE)range: < 13.0.0-r1
- (no CPE)range: < 11.17.0-r1
- (no CPE)range: < 7.8.0-r4
- (no CPE)range: < 5.15.11-r3
- (no CPE)range: < 0.9.0-r1
- (no CPE)range: < 0.9.0-r1
- (no CPE)range: < 0.9.0-r1
- (no CPE)range: < 0.9.0-r1
- (no CPE)range: < 43.249.5-r2
- (no CPE)range: < 1.6.0-r2
- (no CPE)range: < 24.0.2-r1
- (no CPE)range: < 4.125.0-r2
- (no CPE)range: < 13.0.0-r1
- (no CPE)range: < 11.17.0-r1
- (no CPE)range: < 5.15.11-r3
- (no CPE)range: < 43.249.5-r2
- (no CPE)range: < 1.6.0-r2
- (no CPE)range: < 24.0.2-r1
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 3.0.3-3.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:10.9.8-1.22.23.1.2.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 22.23.0-160000.1.1
- (no CPE)range: < 24.18.0-160000.1.1
- (no CPE)range: < 24.17.0-1.1
Patches
Vulnerability mechanics
References
33- cna.openjsf.org/security-advisories.htmlnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-vxpw-j846-p89qghsaADVISORY
- github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89qnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-12151ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:34342nvd
- access.redhat.com/errata/RHSA-2026:35841nvd
- access.redhat.com/errata/RHSA-2026:35842nvd
- access.redhat.com/errata/RHSA-2026:35891nvd
- access.redhat.com/errata/RHSA-2026:35892nvd
- access.redhat.com/errata/RHSA-2026:36621nvd
- access.redhat.com/errata/RHSA-2026:36754nvd
- access.redhat.com/errata/RHSA-2026:36820nvd
- access.redhat.com/errata/RHSA-2026:38009nvd
- access.redhat.com/errata/RHSA-2026:38236nvd
- access.redhat.com/errata/RHSA-2026:39246nvd
- access.redhat.com/errata/RHSA-2026:39868nvd
- access.redhat.com/errata/RHSA-2026:41929nvd
- access.redhat.com/errata/RHSA-2026:41947nvd
- access.redhat.com/errata/RHSA-2026:47728nvd
- access.redhat.com/errata/RHSA-2026:48124nvd
- access.redhat.com/errata/RHSA-2026:48151nvd
- access.redhat.com/errata/RHSA-2026:52399nvd
- access.redhat.com/errata/RHSA-2026:56366nvd
- access.redhat.com/errata/RHSA-2026:56431nvd
- access.redhat.com/errata/RHSA-2026:57013nvd
- access.redhat.com/errata/RHSA-2026:60520nvd
- access.redhat.com/errata/RHSA-2026:62260nvd
- access.redhat.com/errata/RHSA-2026:65126nvd
- access.redhat.com/errata/RHSA-2026:66488nvd
- access.redhat.com/errata/RHSA-2026:66545nvd
- access.redhat.com/security/cve/CVE-2026-12151nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.jsonnvd
News mentions
0No linked articles in our index yet.