Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the maxPayloadSize feature and is also unaffected. Patches: Upgrade to undici >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-17 | 3 | Disclosure1General1Patch1 |
| 2026-06-18 | 1 | Patch1 |
🟠 High: WebSocket DoS, cumulative fragments (CVE-2026-9675). Per-frame size was checked, but not the cumulative size across a fragmented message. An 8.x-only regression (introduced in 8.1.0). Fixed in 8.5.0.
Post summary
A high‑severity WebSocket DoS vulnerability (CVE‑2026‑9675) affecting OpenShift 8.x due to unchecked cumulative fragment size was disclosed and fixed in version 8.5.0.
🚨*CVE* CVE-2026-9675 Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocke… https://www.cve.org/CVERecord?id=CVE-2026-9675 ----- Traducción: Impacto de CVE-20… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑9675, describing a missing cumulative size check in the undici WebSocket client, without providing PoC, exploit, or patch information.
CVE-2026-9675 Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocke… https://www.cve.org/CVERecord?id=CVE-2026-9675
Post summary
The post outlines how the vulnerability operates but lacks any PoC, exploit code, active exploitation reports, or patching information, making it a general disclosure.
🚨 High-severity security fix in undici@8.5.0 just released! Patches CVE-2026-9675. undici WebSocket client vulnerable to denial of service via cumulative fragment bypass. https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq
Post summary
The advisory announces a high‑severity security fix for CVE‑2026‑9675, addressing a WebSocket denial‑of‑service vulnerability mitigated by releasing undici 8.5.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodejs | undici | - | node.js | - |