undici up to 6.23.x/7.23.x WebSocket Frame uncaught exception

Summaryinfo

A vulnerability categorized as problematic has been discovered in undici up to 6.23.x/7.23.x. Affected is an unknown function of the component WebSocket Frame Handler. The manipulation results in uncaught exception. This vulnerability was named CVE-2026-1528. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in undici up to 6.23.x/7.23.x. Affected is an unknown functionality of the component WebSocket Frame Handler. The manipulation with an unknown input leads to a uncaught exception vulnerability. CWE is classifying the issue as CWE-248. An exception is thrown from a function, but it is not caught. This is going to have an impact on availability. CVE summarizes:

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-1528 since 01/28/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 302066 (Linux Distros Unpatched Vulnerability : CVE-2026-1528), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.24.0 or 7.24.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (302066), EUVD (EUVD-2026-11703) and CERT Bund (WID-SEC-2026-0933). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• IBM App Connect Enterprise

Productinfo

Name

• undici

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 6.19
• 6.20
• 6.21
• 6.22
• 6.23
• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12
• 7.13
• 7.14
• 7.15
• 7.16
• 7.17
• 7.18
• 7.19
• 7.20
• 7.21
• 7.22
• 7.23

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion