Undici DoS via Unbounded PerMessageDeflate Decompression (pre6.24.0/7.0.07.24.0)
CVE-2026-1526 Published on March 12, 2026

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Github Repository NVD

Vulnerability Analysis

CVE-2026-1526 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Types

What is a Data Amplification Vulnerability?

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

CVE-2026-1526 has been classified to as a Data Amplification vulnerability or weakness.

Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.


Products Associated with CVE-2026-1526

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Cryostat
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel Eus
 
Red Hat Rhdh
 
Red Hat Openshift Ai
 
Red Hat Openshift Devspaces
 
Red Hat Openshift Pipelines
 
Red Hat Openshift Lightspeed
 
Red Hat Ansible Portal
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Cluster Observability Operator
 

Affected Versions

undici: Red Hat Cryostat 4 on RHEL 9: Red Hat Cryostat 4 on RHEL 9: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Cluster Observability Operator 1.5.0: Red Hat Cluster Observability Operator 1.5.0: Red Hat Cluster Observability Operator 1.5.0: Red Hat Developer Hub 1.8: Red Hat Developer Hub 1.9: Red Hat OpenShift AI 2.16: Red Hat OpenShift Dev Spaces 3.28: Red Hat OpenShift Pipelines 1.2: Red Hat OpenShift Lightspeed: Red Hat OpenShift Lightspeed: Red Hat OpenShift Pipelines: Red Hat Developer Hub: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat Self-service automation portal 2:

Vulnerable Packages

The following package name and versions may be associated with CVE-2026-1526

Package Manager Vulnerable Package Versions Fixed In
npm undici >= 7.0.0, < 7.24.0 7.24.0
npm undici < 6.24.0 6.24.0

Exploit Probability

EPSS
1.15%
Percentile
63.59%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.