The undici WebSocket client enforces a maximum payload size on the cumulative byte count of fragments in a WebSocket message but mistakenly does not enforce a limit on the number of fragments. A malicious server can stream a large number of very small or empty continuation frames that individually comply with per-frame and cumulative-size checks, causing the client to allocate progressively more memory until it is exhausted. This resource exhaustion results in a denial of service of the client process. The weakness is an instance of resource exhaustion and memory leak weaknesses.

Applications that use the undici WebSocket client API (new WebSocket(...)) or the WebSocketStream interface are affected when they connect to any WebSocket endpoint that can be controlled by an attacker. All releases of undici from version 6.17.0 onward contain the vulnerability. The recommended patch is to upgrade to undici 6.26.0 or newer in the 6.x series, 7.28.0 or newer in the 7.x series, or 8.5.0 or newer in the 8.x series.

With a CVSS score of 7.5 the vulnerability is considered high‑severity, and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because the attack requires the attacker to control the WebSocket server that the undici client connects to, the threat is most relevant in scenarios where applications automatically establish WebSocket connections to untrusted servers or where a compromised server can be made to appear legitimate. No workaround is currently available; the only mitigation is to apply the recommended upgrade.