CVE-2026-9675: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Synopsis

This is a denial-of-service vulnerability in the undici WebSocket client, affecting versions 8.0.0 through 8.4.x. The client enforces a per-frame size limit (maxPayloadSize) but fails to enforce the cumulative size of fragmented, uncompressed messages, allowing a malicious or compromised WebSocket server to stream many small fragments that each pass validation but together exhaust process memory. Exploitation requires no authentication and is reachable over the network, causing the affected Node.js process to crash or become unresponsive. A patched-image rebuild at undici 8.5.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate a reachable WebSocket server that the vulnerable client connects to over the network; the attack is initiated by the server side of that connection.

• AuthenticationNot required

  No authentication is required - the attacker only needs the client to establish a WebSocket connection to an attacker-controlled or compromised endpoint.

• Victim interactionNot required

  No user interaction is needed beyond the application's normal operation of opening a WebSocket connection.

• Attack complexityDetail

  The exploit is reliable and condition-free once the client connects; no race conditions or special memory layout are required to trigger unbounded memory growth.

Blast Radius

• The affected client process exhausts available memory as the server streams cumulative fragments past the configured limit.
• The Node.js process hosting the undici WebSocket client crashes or becomes unresponsive, taking down any co-located functionality in the same process.
• No confidential data is disclosed and no data is modified; impact is limited to availability of the affected service.