CVE-2026-1528 in undici
Résumé
par MITRE • 12/03/2026
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.