CVE-2026-12151 undici CVE debrief

Who should care

Defenders responsible for applications using the undici WebSocket client or the WebSocketStream API should assess exposure and prioritize upgrading to a patched version to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-12151 is a denial-of-service vulnerability in the undici WebSocket client that can be exploited by a malicious WebSocket server. Defenders should prioritize upgrading to a patched version to prevent potential attacks. This is particularly important for applications using the undici WebSocket client or the WebSocketStream API that may be induced to connect to untrusted or compromised WebSocket endpoints. The vulnerability allows for unbounded memory growth, resulting in memory exhaustion and denial of service. Affected versions require verification, and mitigation involves upgrading to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0.

• Denial of service due to memory exhaustion
• Potential disruption to application availability
• Need for verification of affected versions and exposure
• Priority for upgrading to a patched version

Technical summary

The undici WebSocket client does not enforce a limit on the number of fragments in a message, allowing a malicious WebSocket server to cause unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the undici WebSocket client or the WebSocketStream API that connect to an attacker-controlled or compromised WebSocket endpoint. The vulnerability is present in undici versions starting from 6.17.0. To mitigate, upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0.

Defensive priority

Defenders should prioritize upgrading to a patched version of undici to prevent potential denial-of-service attacks. This is particularly important for applications using the undici WebSocket client or the WebSocketStream API that may be induced to connect to untrusted or compromised WebSocket endpoints.

Recommended defensive actions

• Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0
• Review and update affected applications using the undici WebSocket client or the WebSocketStream API
• Monitor for potential denial-of-service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and affected versions. Vendor advisories from OpenJSF and Node.js provide additional context and mitigation strategies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.