CVE-2026-9675

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected. Patches: Upgrade to undici >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

• CWE-400
• CWE-770

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhqVendor Advisory

Published

Jun 17, 2026

Last Modified

Jun 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96744Improper neutralization of special elements in data query lo…7.1
• CVE-2026-96745Deserialization of untrusted data in the command monitoring …5.6
• CVE-2026-96746An out-of-bounds write in the connection-monitoring logic of…6.5
• CVE-2026-96747The client-side field level encryption support in the MongoD…5
• CVE-2026-96748PyMongo's connection string parsing decodes percent-encoded …6.5
• CVE-2026-96749An integer overflow in the BSON document encoding component …8.4
• CVE-2026-96750MongoDB Compass can interpolate a database name without esca…7.1
• CVE-2026-96751A vulnerability has been found in pmTicket Project-Managemen…7.3
• CVE-2026-96752The Zero Spam for WordPress plugin for WordPress is vulnerab…7.2
• CVE-2026-96754orval versions before 8.29.0 contain a code injection vulner…9.8
• CVE-2026-96755orval versions 8.14.0 through 8.28.1 contain a code injectio…9.8
• CVE-2026-96756orval versions before 8.30.0 contain a code injection vulner…8.1