CVE-2026-1528
High
Description
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNodejs Undici
PublishedMar 12, 2026
First seenMar 12, 2026
Weakness typeCWE-248CWE-248CWE-1284CWE-1284
How to fix
Update
- nodejs undici6.24.0, 7.24.0 or later
- undici6.24.0, 7.24.0 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2026:17789
- access.redhat.com/errata/RHSA-2026:7310
- access.redhat.com/errata/RHSA-2026:7080
- access.redhat.com/errata/RHSA-2026:7675
- access.redhat.com/errata/RHSA-2026:7123
- access.redhat.com/errata/RHSA-2026:7670
- access.redhat.com/errata/RHSA-2026:7983
- access.redhat.com/errata/RHSA-2026:7302
- access.redhat.com/errata/RHSA-2026:7350
- access.redhat.com/errata/RHSA-2026:34342
- access.redhat.com/errata/RHSA-2026:9742
- access.redhat.com/errata/RHSA-2026:13826
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs undici | v < 6.24.0, 7.0.0 ≤ v < 7.24.0 | 6.24.0, 7.24.0 |
| undicinpm | 6.0.0 ≤ v < 6.24.0, 7.0.0 ≤ v < 7.24.0 | 6.24.0, 7.24.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.