CVE-2026-1526: Undici WebSocket Client DoS Vulnerability

CVE-2026-1526 Overview

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.

The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Critical Impact

A malicious WebSocket server can send specially crafted compressed frames that expand to massive sizes in memory, causing complete denial of service through memory exhaustion in Node.js applications using the undici WebSocket client.

Affected Products

• undici WebSocket client (versions with permessage-deflate support)
• Node.js applications using undici for WebSocket connections
• Services implementing WebSocket clients with permessage-deflate extension negotiation

Discovery Timeline

• 2026-03-12 - CVE-2026-1526 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-1526

Vulnerability Analysis

This vulnerability is classified as CWE-409 (Improper Handling of Highly Compressed Data), commonly known as a decompression bomb or "zip bomb" attack. The undici WebSocket client implements the permessage-deflate extension as defined in IETF RFC 7692, which allows WebSocket frames to be compressed using the DEFLATE algorithm to reduce bandwidth consumption.

The fundamental flaw lies in the absence of size validation during the decompression process. When the WebSocket client receives a compressed frame, it passes the data to the PerMessageDeflate.decompress() method. This method decompresses the incoming data in chunks and accumulates all decompressed chunks in memory before concatenating them into a single Buffer. At no point does the implementation verify whether the cumulative decompressed size exceeds safe memory boundaries.

An attacker controlling a malicious WebSocket server can craft a small compressed payload (potentially only a few kilobytes) that decompresses to gigabytes of data. Since the decompression happens synchronously in memory and the client has no awareness of the final decompressed size until the entire operation completes, the Node.js process rapidly consumes all available memory, leading to process termination or system-wide instability.

Root Cause

The root cause is the missing size validation in the PerMessageDeflate.decompress() method. The implementation unconditionally accumulates all decompressed data chunks without enforcing a maximum decompressed size threshold. This design oversight allows attackers to exploit the inherent compression ratio asymmetry of the DEFLATE algorithm, where highly repetitive data can achieve compression ratios exceeding 1000:1.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker must operate or compromise a WebSocket server that the vulnerable client connects to. The attack sequence involves:

1. The client initiates a WebSocket connection and negotiates the permessage-deflate extension
2. The malicious server accepts the connection and extension negotiation
3. The server sends a small, highly compressed WebSocket frame containing repetitive data
4. The client's PerMessageDeflate.decompress() method begins decompression
5. The decompressed data rapidly fills available memory
6. The Node.js process crashes due to memory exhaustion or becomes unresponsive

The vulnerability is particularly severe because clients connecting to untrusted WebSocket endpoints have no defense against this attack without patching or disabling the permessage-deflate extension entirely.

Detection Methods for CVE-2026-1526

Indicators of Compromise

• Sudden spikes in Node.js process memory consumption when handling WebSocket connections
• Node.js processes crashing with out-of-memory errors during WebSocket communication
• Abnormally small WebSocket frames received from servers that trigger high memory allocation
• WebSocket connections with permessage-deflate negotiation from untrusted endpoints

Detection Strategies

• Monitor Node.js process memory utilization and set alerts for rapid memory consumption increases
• Implement application-level logging to track WebSocket frame sizes before and after decompression
• Use runtime protection tools that can detect and terminate processes exhibiting resource exhaustion patterns
• Deploy network monitoring to identify unusually small WebSocket frames from external servers

Monitoring Recommendations

• Configure memory limits for Node.js processes using --max-old-space-size to prevent system-wide impact
• Implement health checks that can detect and restart unresponsive Node.js processes
• Review WebSocket connection logs for connections to untrusted or newly observed endpoints
• Enable SentinelOne's runtime application protection to detect abnormal memory allocation patterns

How to Mitigate CVE-2026-1526

Immediate Actions Required

• Update undici to a patched version that includes decompression size limits
• Disable the permessage-deflate extension on WebSocket connections to untrusted servers as a temporary workaround
• Review and restrict which external WebSocket endpoints your applications connect to
• Implement process-level memory limits to contain the blast radius of potential exploitation

Patch Information

Refer to the GitHub Security Advisory GHSA-vrm6-8vpv-qv8q for official patch information and fixed versions. The OpenJS Security Advisories page provides additional guidance on securing Node.js applications. The vulnerability was also reported via HackerOne Report #3481206.

Workarounds

• Disable permessage-deflate extension negotiation when creating WebSocket clients connecting to untrusted endpoints
• Implement a reverse proxy or WebSocket gateway that can inspect and limit decompressed frame sizes before forwarding to backend services
• Set strict memory limits on Node.js processes using container resource constraints or the --max-old-space-size flag
• Consider implementing custom decompression wrappers with size validation until official patches are applied

# Configuration example - Set Node.js memory limits to contain resource exhaustion
# Limit Node.js process to 512MB of heap memory
node --max-old-space-size=512 your-application.js

# For containerized deployments, set memory limits in Docker
# docker run --memory="1g" --memory-swap="1g" your-node-app