CVE-2026-1528

Name of the Vulnerable Software and Affected Versions undici versions prior to 7.24.0 undici versions prior to 6.24.0

Description A server can respond with a WebSocket frame utilizing the 64-bit length format and an excessively large length value. The ByteParser component within undici experiences an integer overflow during internal mathematical operations, leading to an invalid state and ultimately causing a fatal TypeError that terminates the process.

Recommendations Upgrade to undici version 7.24.0 or later. Upgrade to undici version 6.24.0 or later.