CVE-2026-9675

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected. Patches: Upgrade to undici >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

• CWE-400
• CWE-770

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhqVendor Advisory

Published

Jun 17, 2026

Last Modified

Jun 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9656The HubSpot All-In-One Marketing – Forms, Popups, Live Chat …4.3
• CVE-2026-9658Plack::Middleware::Security::Common versions before 0.13.1 f…7.3
• CVE-2026-9662The Recover Exit For WooCommerce plugin for WordPress is vul…8.1
• CVE-2026-9669bz2.BZ2Decompressor objects could be reused after a decompre…8.2
• CVE-2026-9673Versions of the package json-2-csv from 3.15.0 and before 5.…6.8
• CVE-2026-9674A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2026-9676The F4 Post Tree WordPress plugin before 2.0.5 does not perf…4.3
• CVE-2026-9677The Shariff for WordPress Shariff for WordPress plugin throu…4.8
• CVE-2026-9678Impact: Undici's cache interceptor incorrectly classifies so…5.9
• CVE-2026-9679Impact: undici's cookie parser in parseSetCookie percent-dec…5.9
• CVE-2026-9680Improper exposure of the MCP server in alibabacloud-rds-open…5.8
• CVE-2026-9689A flaw was found in Keycloak, an open-source identity and ac…4.2