CVE-2026-109932

undici is an HTTP client library for Node.js.

Undici

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while…

15. Okt 2026

Ausgewertete Quellen

• Hersteller
  https://cna.openjsf.org/security-advisories.html
• NVD
  CVE-2026-109932
• GitHub
  https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6