CVE-2026-1528

HIGH

7.5

Descripcion

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado3/12/2026

Ultima modificacion3/20/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

nodejs:undici

Debilidades (CWE)

CWE-248CWE-1284

Referencias

https://cna.openjsf.org/security-advisories.html(ce714d77-add3-4f53-aff5-83d477b104bb)

https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj(ce714d77-add3-4f53-aff5-83d477b104bb)

https://hackerone.com/reports/3537648(ce714d77-add3-4f53-aff5-83d477b104bb)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.