Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-12151

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 52.2%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-12151
  • Nodejs » Undici » Version: 6.17.0
    cpe:2.3:a:nodejs:undici:6.17.0
  • Nodejs » Undici » Version: 6.18.0
    cpe:2.3:a:nodejs:undici:6.18.0
  • Nodejs » Undici » Version: 6.18.1
    cpe:2.3:a:nodejs:undici:6.18.1
  • Nodejs » Undici » Version: 6.18.2
    cpe:2.3:a:nodejs:undici:6.18.2
  • Nodejs » Undici » Version: 6.19.0
    cpe:2.3:a:nodejs:undici:6.19.0
  • Nodejs » Undici » Version: 6.19.1
    cpe:2.3:a:nodejs:undici:6.19.1
  • Nodejs » Undici » Version: 6.19.2
    cpe:2.3:a:nodejs:undici:6.19.2
  • Nodejs » Undici » Version: 6.19.3
    cpe:2.3:a:nodejs:undici:6.19.3
  • Nodejs » Undici » Version: 6.19.4
    cpe:2.3:a:nodejs:undici:6.19.4
  • Nodejs » Undici » Version: 6.19.5
    cpe:2.3:a:nodejs:undici:6.19.5
  • Nodejs » Undici » Version: 6.19.6
    cpe:2.3:a:nodejs:undici:6.19.6
  • Nodejs » Undici » Version: 6.19.7
    cpe:2.3:a:nodejs:undici:6.19.7
  • Nodejs » Undici » Version: 6.19.8
    cpe:2.3:a:nodejs:undici:6.19.8
  • Nodejs » Undici » Version: 6.20.0
    cpe:2.3:a:nodejs:undici:6.20.0
  • Nodejs » Undici » Version: 6.20.1
    cpe:2.3:a:nodejs:undici:6.20.1
  • Nodejs » Undici » Version: 6.21.0
    cpe:2.3:a:nodejs:undici:6.21.0
  • Nodejs » Undici » Version: 6.23.0
    cpe:2.3:a:nodejs:undici:6.23.0
  • Nodejs » Undici » Version: 6.24.0
    cpe:2.3:a:nodejs:undici:6.24.0
  • Nodejs » Undici » Version: 6.24.1
    cpe:2.3:a:nodejs:undici:6.24.1
  • Nodejs » Undici » Version: 6.25.0
    cpe:2.3:a:nodejs:undici:6.25.0
  • Nodejs » Undici » Version: 6.26.0
    cpe:2.3:a:nodejs:undici:6.26.0
  • Nodejs » Undici » Version: 7.0.0
    cpe:2.3:a:nodejs:undici:7.0.0
  • Nodejs » Undici » Version: 7.1.0
    cpe:2.3:a:nodejs:undici:7.1.0
  • Nodejs » Undici » Version: 7.1.1
    cpe:2.3:a:nodejs:undici:7.1.1
  • Nodejs » Undici » Version: 7.10.0
    cpe:2.3:a:nodejs:undici:7.10.0
  • Nodejs » Undici » Version: 7.11.0
    cpe:2.3:a:nodejs:undici:7.11.0
  • Nodejs » Undici » Version: 7.12.0
    cpe:2.3:a:nodejs:undici:7.12.0
  • Nodejs » Undici » Version: 7.13.0
    cpe:2.3:a:nodejs:undici:7.13.0
  • Nodejs » Undici » Version: 7.14.0
    cpe:2.3:a:nodejs:undici:7.14.0
  • Nodejs » Undici » Version: 7.15.0
    cpe:2.3:a:nodejs:undici:7.15.0
  • Nodejs » Undici » Version: 7.16.0
    cpe:2.3:a:nodejs:undici:7.16.0
  • Nodejs » Undici » Version: 7.17.0
    cpe:2.3:a:nodejs:undici:7.17.0
  • Nodejs » Undici » Version: 7.18.0
    cpe:2.3:a:nodejs:undici:7.18.0
  • Nodejs » Undici » Version: 7.18.1
    cpe:2.3:a:nodejs:undici:7.18.1
  • Nodejs » Undici » Version: 7.18.2
    cpe:2.3:a:nodejs:undici:7.18.2
  • Nodejs » Undici » Version: 7.19.0
    cpe:2.3:a:nodejs:undici:7.19.0
  • Nodejs » Undici » Version: 7.19.1
    cpe:2.3:a:nodejs:undici:7.19.1
  • Nodejs » Undici » Version: 7.19.2
    cpe:2.3:a:nodejs:undici:7.19.2
  • Nodejs » Undici » Version: 7.2.0
    cpe:2.3:a:nodejs:undici:7.2.0
  • Nodejs » Undici » Version: 7.2.1
    cpe:2.3:a:nodejs:undici:7.2.1
  • Nodejs » Undici » Version: 7.2.2
    cpe:2.3:a:nodejs:undici:7.2.2
  • Nodejs » Undici » Version: 7.2.3
    cpe:2.3:a:nodejs:undici:7.2.3
  • Nodejs » Undici » Version: 7.20.0
    cpe:2.3:a:nodejs:undici:7.20.0
  • Nodejs » Undici » Version: 7.21.0
    cpe:2.3:a:nodejs:undici:7.21.0
  • Nodejs » Undici » Version: 7.22.0
    cpe:2.3:a:nodejs:undici:7.22.0
  • Nodejs » Undici » Version: 7.23.0
    cpe:2.3:a:nodejs:undici:7.23.0
  • Nodejs » Undici » Version: 7.24.0
    cpe:2.3:a:nodejs:undici:7.24.0
  • Nodejs » Undici » Version: 7.24.1
    cpe:2.3:a:nodejs:undici:7.24.1
  • Nodejs » Undici » Version: 7.24.2
    cpe:2.3:a:nodejs:undici:7.24.2
  • Nodejs » Undici » Version: 7.24.3
    cpe:2.3:a:nodejs:undici:7.24.3
  • Nodejs » Undici » Version: 7.24.4
    cpe:2.3:a:nodejs:undici:7.24.4
  • Nodejs » Undici » Version: 7.24.5
    cpe:2.3:a:nodejs:undici:7.24.5
  • Nodejs » Undici » Version: 7.24.6
    cpe:2.3:a:nodejs:undici:7.24.6
  • Nodejs » Undici » Version: 7.24.7
    cpe:2.3:a:nodejs:undici:7.24.7
  • Nodejs » Undici » Version: 7.24.8
    cpe:2.3:a:nodejs:undici:7.24.8
  • Nodejs » Undici » Version: 7.25.0
    cpe:2.3:a:nodejs:undici:7.25.0
  • Nodejs » Undici » Version: 7.26.0
    cpe:2.3:a:nodejs:undici:7.26.0
  • Nodejs » Undici » Version: 7.27.0
    cpe:2.3:a:nodejs:undici:7.27.0
  • Nodejs » Undici » Version: 7.27.1
    cpe:2.3:a:nodejs:undici:7.27.1
  • Nodejs » Undici » Version: 7.27.2
    cpe:2.3:a:nodejs:undici:7.27.2
  • Nodejs » Undici » Version: 7.3.0
    cpe:2.3:a:nodejs:undici:7.3.0
  • Nodejs » Undici » Version: 7.4.0
    cpe:2.3:a:nodejs:undici:7.4.0
  • Nodejs » Undici » Version: 7.5.0
    cpe:2.3:a:nodejs:undici:7.5.0
  • Nodejs » Undici » Version: 7.6.0
    cpe:2.3:a:nodejs:undici:7.6.0
  • Nodejs » Undici » Version: 7.7.0
    cpe:2.3:a:nodejs:undici:7.7.0
  • Nodejs » Undici » Version: 7.8.0
    cpe:2.3:a:nodejs:undici:7.8.0
  • Nodejs » Undici » Version: 7.9.0
    cpe:2.3:a:nodejs:undici:7.9.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved