undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Vulnerability

Overview

CVE-2026-1526 is a denial-of-service vulnerability in the undici HTTP/1.1 client for Node.js, specifically in its WebSocket implementation. The bug resides in the PerMessageDeflate.decompress() method, which handles decompression of incoming WebSocket frames when the permessage-deflate extension is negotiated. The method accumulates all decompressed chunks into a single Buffer without enforcing any limit on the total size, allowing a malicious server to send a small compressed frame that expands to an extremely large size in memory—a classic decompression bomb [1][2].

Exploitation

Conditions

Exploitation requires the client to establish a WebSocket connection with a server that negotiates the permessage-deflate extension. The attacker must control the server endpoint or be able to inject malicious frames into an existing connection. No authentication or special network position is needed beyond the ability to send WebSocket frames; the attack is triggered purely by receiving a crafted compressed message [2].

Impact

A successful attack causes the Node.js process to exhaust all available memory, leading to a crash or unresponsiveness. This constitutes a denial of service (DoS) against the application using undici, potentially affecting all users of that service. The OWASP Denial of Service attack category describes such resource exhaustion as a direct threat to availability [3].

Mitigation

Status

As of the publication date (2026-03-12), no patch has been announced in the provided references. Users should monitor the undici repository [2] and the OpenJS Foundation security advisories [4] for updates. Until a fix is released, disabling the permessage-deflate extension on the client side or limiting WebSocket connections to trusted servers may reduce risk.