CVE-2026-109932

Name of the Vulnerable Software and Affected Versions undici versions 5.15.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1

Description The WebSocket client in this HTTP client library for Node.js can be forced to exhaust process memory by a malicious or compromised WebSocket server. When the client receives a PING frame, it automatically sends a PONG response but ignores the backpressure signal from the socket write. A server that sends small PING frames without reading the resulting PONGs causes the outbound write queue and heap to grow indefinitely, leading to process termination due to memory exhaustion. This remote, unauthenticated attack requires only a standard WebSocket connection and impacts system availability.

Recommendations Update versions 5.15.0 through 6.29.0 to 6.29.1 or later. Update versions 7.0.0 through 7.30.0 to 7.30.1 or later. Update versions 8.0.0 through 8.12.1 to 8.12.2 or later.