--- cve: "CVE-2026-12151" severity: "HIGH" cvss: 7.5 epss: "0.8%" vendor: "undici" kev: false exploited: false published: "2026-06-17 17:16:42" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-20T18:29:20+02:00" --- # CVE-2026-12151 > 7.5 HIGH · 🧪 PoC ## Beschreibung Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Keine | good | | I Integrität | Keine | good | | A Verfügbarkeit | Hoch | bad | ## Patch verfügbar (OSV) - 551138cbc1742c92242a68216167761075e8a82c (Commit) - f9eba0ad9134e1c0977848476bba9d49734696e4 (Commit) ## Referenzen - - - - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-12151) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_