CVE-2026-1528: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

March 13, 2026

A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici’s ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

References

cna.openjsf.org/security-advisories.html
github.com/advisories/GHSA-f269-vfmq-vjvj
github.com/nodejs/undici
github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
hackerone.com/reports/3537648
nvd.nist.gov/vuln/detail/CVE-2026-1528

Code Behaviors & Features

Detect and mitigate CVE-2026-1528 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →