HighGHSA-f269-vfmq-vjvjCVE-2026-1528
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
Published 13 Mar 2026 · Updated 10 Sept 2026
Affected packages
undicinpm
- Affected
- >=6.0.0 <6.24.0
- Fixed in
- 6.24.0
Update to the fixed version for your release line, for example:
npm install undici@6.24.0undicinpm
- Affected
- >=7.0.0 <7.24.0
- Fixed in
- 7.24.0
Update to the fixed version for your release line, for example:
npm install undici@7.24.0Details
Impact
A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Workarounds
There are no workarounds.
Is GHSA-f269-vfmq-vjvj in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.