Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-12 | 2 | Disclosure1Patch1 |
| 2026-03-13 | 2 | General2 |
Found another with @OpenAI Codex, this time in undici's ByteParser https://www.cve.org/CVERecord?id=CVE-2026-1528
Post summary
The tweet notes the discovery of CVE-2026-1528 in undici's ByteParser using OpenAI Codex, but provides no additional technical detail, PoC, patch information, or evidence of exploitation.
🚨 High-severity security fix in undici@7.24.0 just released! Patches CVE-2026-1528 — vulnerable to Malicious WebSocket 64-bit frame length handling could crash the client. https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
Post summary
A high‑severity security fix for undici 7.24.0 has been released, addressing CVE‑2026‑1528 which allows malicious WebSocket 64‑bit frame length handling to crash the client.
CVE-2026-1528 Undici WebSocket Frame Length Parsing Vulnerability Leading to Pro... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1528 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post announces CVE-2026-1528 and provides a link to vulnerability details and alert subscription, but offers no further technical or exploit information.
CVE-2026-1528 ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an i… https://www.cve.org/CVERecord?id=CVE-2026-1528
Post summary
The CVE‑2026-1528 disclosure reveals an integer overflow in the undici ByteParser triggered by a WebSocket frame with an excessively large 64‑bit length, but no PoC, exploit, or mitigation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodejs | undici | - | node.js | - |