CVE-2026-109932: Node.js Undici WebSocket DOS Vulnerability

CVE-2026-109932 Overview

CVE-2026-109932 is a resource exhaustion vulnerability [CWE-400] in undici, the HTTP client library used by Node.js. The flaw affects the bundled WebSocket client across versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1. A malicious or compromised WebSocket server can stream small PING frames to a connected client. The client automatically answers each PING with a PONG and ignores socket backpressure, so the outbound write queue and heap grow until the Node.js process terminates. The attack is remote, unauthenticated, and asymmetric: small inbound traffic produces a much larger retained outbound queue.

Critical Impact
An unauthenticated remote WebSocket server can crash any Node.js process that connects to it, enabling denial of service against clients, bots, scrapers, and server-to-server integrations.

Affected Products

nodejs/undici versions 5.15.0 through 6.29.0
nodejs/undici versions 7.0.0 through 7.30.0
nodejs/undici versions 8.0.0 through 8.12.1 (including the WebSocket client bundled with Node.js)

Discovery Timeline

2026-10-15 - CVE-2026-109932 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-109932

Vulnerability Analysis

The vulnerability lives in the WebSocket client's PING/PONG handling path. Per RFC 6455, a WebSocket endpoint must respond to each PING control frame with a matching PONG. undici performs this response automatically, but the implementation writes the PONG frame to the underlying socket without checking the return value of the write or honoring the drain event. Frame parsing continues at full speed even when the TCP send buffer is full and the kernel is applying backpressure.

When a hostile server streams tiny PING frames and never reads from the TCP connection, the client's outbound queue grows unbounded. Each queued PONG retains memory on the Node.js heap. Because PING frames are only a few bytes on the wire but trigger buffered PONGs plus associated bookkeeping, the amplification is substantial. The process runs out of memory and terminates. The CWE-400 classification reflects uncontrolled resource consumption; impact is limited to availability.

Root Cause

The automatic PONG responder does not propagate socket backpressure into the frame parser. The parser keeps consuming inbound PING frames and enqueuing PONG writes regardless of whether the socket is writable. Nothing bounds the outbound queue.

Attack Vector

An attacker only needs a Node.js application to establish an outbound WebSocket connection to a server they control. Common exposure paths include webhook callbacks, outbound scrapers, chat and streaming integrations, server-sent telemetry clients, and server-side rendering flows that fetch remote resources. Once the connection is established, the server emits a continuous stream of small PING frames and refuses to read from the socket. The client exhausts memory and the Node.js process exits.

No authentication, user interaction, or special protocol extension is required. Any fetch-based or explicit WebSocket client in affected Node.js runtimes is reachable.

Detection Methods for CVE-2026-109932

Indicators of Compromise

Node.js processes terminating with FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory shortly after initiating outbound WebSocket connections.
Sustained inbound WebSocket PING frames from a single remote endpoint without corresponding application traffic.
Growing resident set size (RSS) on Node.js workers correlated with active WebSocket sessions to untrusted servers.

Detection Strategies

Inventory applications for undici versions matching the vulnerable ranges using npm ls undici or software composition analysis tooling.
Instrument WebSocket client code paths to log remote endpoints and frame-type counters, flagging sessions with abnormally high inbound PING-to-data ratios.
Correlate process restart events in orchestrators (Kubernetes OOMKilled, systemd Main process exited) with recent outbound WebSocket activity.

Monitoring Recommendations

Alert on Node.js container restarts caused by OOM conditions, particularly for workloads that make outbound WebSocket calls.
Monitor egress WebSocket destinations and apply allowlists where feasible to limit exposure to untrusted servers.
Track undici version drift across repositories and base images in continuous integration pipelines.

How to Mitigate CVE-2026-109932

Immediate Actions Required

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2, or later across all Node.js services and container images.
Update bundled Node.js runtimes to a release that ships the patched undici and rebuild downstream artifacts.
Audit applications that use fetch, WebSocket, or undici.WebSocket to connect to third-party or user-controlled URLs.

Patch Information

The fix pauses WebSocket frame parsing when the automatic PONG write encounters socket backpressure and resumes parsing on the drain event. This bounds the outbound queue to roughly one in-flight PONG per connection. Patched releases are undici6.29.1, 7.30.1, and 8.12.2. Refer to the GitHub Security Advisory GHSA-9fm3-97px-rjf6 and the OpenJS Foundation Security Advisories.

Workarounds

No workaround exists. Upgrading to a patched undici release is the only remediation.
As a defense-in-depth measure, restrict outbound WebSocket connections to trusted destinations via egress policy or network ACLs until patches are deployed.

bash

# Upgrade undici to a patched release
npm install undici@^8.12.2
# or, for the 7.x line
npm install undici@^7.30.1
# or, for the 6.x line
npm install undici@^6.29.1

# Verify the installed version
npm ls undici