Discovery API Icon
Discovery API
Security Advisory Icon
Security Advisory
Package Manager Icon
Package Manager
Alpaquita LinuxStreamSecurity Advisory
Search Cve

CVE-2026-1528

Published: March 13, 2026Last modified: June 16, 2026

Description

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Severity score breakdown

ParameterValue
Base score7.5
Attack VectorNETWORK
Attack complexityLOW
Privileges requiredNONE
User interactionNONE
ScopeUNCHANGED
ConfidentialityNONE
Integrity impactNONE
Availability impactHIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Status

ProductReleasePackageStatus
Alpaquita Linux23 LTSnodejsFixed (20.20.2-r0)
25 LTSnodejsFixed (22.22.2-r0)
StreamnodejsFixed (24.16.0-r0)
Hardened Containers23 LTSnodejsFixed (20.20.2-r0)
25 LTSnodejsFixed (22.22.2-r0)
StreamnodejsFixed (24.16.0-r0)

References

ON THIS PAGE