undici WebSocket client vulnerable to denial of service via fragment count bypass
Summary
| CVE | CVE-2026-12151 |
|---|---|
| State | PUBLISHED |
| Assigner | openjs |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-17 17:16:42 UTC |
| Updated | 2026-08-24 13:17:22 UTC |
| Description | Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.004260000 probability, percentile 0.340160000 (date 2026-06-24)
Problem Types: CWE-400 | CWE-770 | CWE-400 CWE-400: Uncontrolled Resource Consumption | CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling | CWE-770 Allocation of Resources Without Limits or Throttling
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | ce714d77-add3-4f53-aff5-83d477b104bb | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Undici | Undici | affected 6.26.0 semver | Not specified |
| CNA | Undici | Undici | unaffected 6.26.0 semver | Not specified |
| CNA | Undici | Undici | affected 7.0.0 7.28.0 semver | Not specified |
| CNA | Undici | Undici | unaffected 7.28.0 semver | Not specified |
| CNA | Undici | Undici | affected 8.0.0 8.5.0 semver | Not specified |
| CNA | Undici | Undici | unaffected 8.5.0 semver | Not specified |
| ADP | Red Hat | Cryostat 4 On RHEL 9 | unaffected 4.2.0-13 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 1:24.18.0-1.el10_2 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 1:22.23.1-2.el10_2 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 1:22.23.1-2.el10_0 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260630152626.6d880403 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260703140402.6d880403 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 9080020260626074955.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 9080020260626075442.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 9060020260804140259.rhel9 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782840519 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839981 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839193 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782838753 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839279 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782840539 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782841925 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782844225 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839658 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782838476 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839996 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.0 | unaffected 1782839494 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1783448184 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1784210921 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 26.5.0-1.3.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 24.18.0-0.3.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.16 | unaffected 1783306396 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.17 | unaffected 1784744859 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705347 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706101 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705558 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705646 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706138 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705741 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705777 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705802 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705938 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706577 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706125 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706177 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706188 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706679 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706357 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706612 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706644 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706659 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706880 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786701839 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786701555 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702052 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702559 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702713 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702264 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702448 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702276 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702440 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702315 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703071 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702563 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702636 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702623 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703137 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702716 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702872 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702949 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702917 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703143 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627460 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786626399 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628235 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627106 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629761 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627559 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786687918 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629478 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628142 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786631508 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628053 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627382 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627430 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629076 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627469 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786644072 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786688215 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628340 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628623 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786632256 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628935 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629548 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1782498792 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1783007534 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1782989367 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1785245777 * rpm | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | Red Hat AMQ Broker 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Podman Desktop | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:47728 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| cna.openjsf.org/security-advisories.html | ce714d77-add3-4f53-aff5-83d477b104bb | cna.openjsf.org | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:57013 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36621 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q | ce714d77-add3-4f53-aff5-83d477b104bb | github.com | Vendor Advisory |
| access.redhat.com/security/cve/CVE-2026-12151 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:35891 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:35842 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:52399 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:34342 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36754 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41947 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:35892 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:35841 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:39246 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:39868 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41929 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:38236 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36820 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:56366 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:48124 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:38009 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:48151 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:56431 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: lpinca (en)
CNA: Nadav0077 (en)
CNA: UlisesGascon (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-06-17T17:01:45.297Z | Reported to Red Hat. |
| ADP | 2026-06-17T16:05:38.785Z | Made public. |
Solutions
ADP: RHSA-2026:48151: Cryostat 4 on RHEL 9
ADP: RHSA-2026:39246: Red Hat Enterprise Linux AppStream EUS (v. 10.0)
ADP: RHSA-2026:35842: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:35841: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:41947: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:39868: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:52399: Red Hat Enterprise Linux AppStream EUS (v.9.6)
ADP: RHSA-2026:35892: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:35891: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:34342: Cluster Observability Operator 1.5.0
ADP: RHSA-2026:36754: Red Hat Developer Hub 1.10
ADP: RHSA-2026:41929: Red Hat Developer Hub 1.9
ADP: RHSA-2026:38236: Red Hat Hardened Images
ADP: RHSA-2026:38009: Red Hat Hardened Images
ADP: RHSA-2026:36621: Red Hat OpenShift Container Platform 4.16
ADP: RHSA-2026:47728: Red Hat OpenShift Container Platform 4.17
ADP: RHSA-2026:48124: Red Hat OpenShift Dev Spaces 3.29
ADP: RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29
ADP: RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18
ADP: RHSA-2026:56366: Red Hat Openshift Data Foundation 4.19
ADP: RHSA-2026:57013: Red Hat Openshift Data Foundation 4.2
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.