CVE-2026-1526

CVE-2026-1526 is a high-severity vulnerability in Nodejs Undici with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-409.

Key facts

Description

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Frequently asked questions

What is CVE-2026-1526?
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.
How severe is CVE-2026-1526?
CVE-2026-1526 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-1526 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-1526?
CVE-2026-1526 affects Nodejs Undici. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-1526?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-1526 have an EU (EUVD) identifier?
Yes. CVE-2026-1526 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-11699.
When was CVE-2026-1526 published?
CVE-2026-1526 was published on 2026-03-12 and last updated on 2026-07-02.

References

Affected products (1)

More vulnerabilities in Nodejs Undici

All CVEs affecting Nodejs Undici →

Other CWE-409 vulnerabilities

Browse all CWE-409 vulnerabilities →