The undici WebSocket client enforces `maxPayloadSize` on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the `new WebSocket(...)` client that connect to compromised or attacker-controlled endpoints.