CVE-2026-12151: undici WebSocket client vulnerable to denial of service via fragment count bypass

Synopsis

This is a denial-of-service vulnerability in the undici WebSocket client. A malicious or compromised WebSocket server can send a large number of small or empty continuation frames that individually pass undici's per-frame and cumulative payload size checks, causing unbounded memory growth in the connecting client process until memory is exhausted. No authentication or special conditions are required for a server to trigger this against any client that connects to it. Patched-image rebuilds at undici 6.26.0, 7.28.0, and 8.5.0 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate or control a WebSocket server reachable over the network that the vulnerable undici client connects to.

• AuthenticationNot required

  No authentication is required; any WebSocket server the client connects to can send malicious continuation frames without any credentials.

• Victim interactionNot required

  No user interaction is needed beyond the client application establishing a WebSocket connection, which may happen automatically.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; the attacker simply streams small or empty continuation frames with no race conditions or special memory layout requirements.

Blast Radius

• The client process accumulates unbounded in-memory frame buffer data, exhausting available memory on the host.
• Memory exhaustion crashes or hangs the affected Node.js process, taking down any service built on that undici WebSocket client instance.
• If the affected process shares a container or pod with other workloads, memory pressure can degrade or terminate those co-located services as well.