CVE-2026-109932 undici CVE debrief

Who should care

Node.js developers and administrators using the undici library are advised to upgrade to a patched version to prevent potential process memory exhaustion. They should review and update affected systems and dependencies, and monitor for potential Denial of Service attacks.

Why it matters

The undici WebSocket client vulnerability can lead to Denial of Service attacks, and defenders should upgrade to a patched version to prevent potential process memory exhaustion.

• Denial of Service attacks via unbounded automatic PONG buffering
• Potential for process memory exhaustion
• Need for upgrade to patched version

Technical summary

The undici WebSocket client is vulnerable to Denial of Service via unbounded automatic PONG buffering. A malicious or compromised WebSocket server can drive the client to exhaust process memory by streaming small PING frames while never reading the client's PONGs. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2.

Defensive priority

Upgrade to a patched version of undici to prevent Denial of Service attacks

Recommended defensive actions

• Upgrade to undici version 6.29.1, 7.30.1, or 8.12.2 or later
• Review and update affected systems and dependencies
• Monitor for potential Denial of Service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and patched versions. The vulnerability has been publicly disclosed and is exploitable via a normal WebSocket connection. There is no workaround available, but defenders should verify the affected scope and upgrade to a patched version to prevent potential process memory exhaustion. The CVE record was published on 2026-10-15T18:44:22.571Z and has not been modified since then. The source item provides additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.