--- id: CVE-2026-1528 title: >- ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length summary: >- ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the proces… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-248 - CWE-1284 vendor: nodejs product: undici affected: - undici < 6.24.0 - 'undici >= 7.0.0, < 7.24.0' patched: - undici 7.24.0 published: '2026-03-12' updated: '2026-07-02' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-1528' references: - url: 'https://cna.openjsf.org/security-advisories.html' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://hackerone.com/reports/3537648' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://access.redhat.com/errata/RHSA-2026:13826' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:17789' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21772' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21931' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34342' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:5807' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7080' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7123' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7302' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7310' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7350' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7670' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7675' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7983' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:9742' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-1528' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2447145' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1528.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-1528' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-1528' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.00488 epssPercentile: 0.4116 ingestedAt: '2026-07-02T12:34:40.379Z' ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-03-13T13:03:59.738320Z' --- ## Overview ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later. ## Affected - `undici < 6.24.0` - `undici >= 7.0.0, < 7.24.0` ## Remediation Upgrade past the affected range: - `undici 7.24.0` ## Vendor advisories - **RHSA-2026:17789** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:17789) - **RHSA-2026:7310** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7310) - **RHSA-2026:7080** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7080) - **RHSA-2026:7675** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7675) - **RHSA-2026:7123** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7123) - **RHSA-2026:7670** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7670) - **RHSA-2026:7983** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-04-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:7983) - **RHSA-2026:7302** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7302) - **RHSA-2026:7350** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7350) - **RHSA-2026:34342** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34342) - **RHSA-2026:9742** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-04-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:9742) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, OpenShift Pipelines, Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI), Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, OpenShift Lightspeed, OpenShift Pipelines, Red Hat OpenShift AI (RHOAI), … · updated 2026-09-12 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1528.json)