The vulnerability is a 64‑bit length overflow in undici's ByteParser when a WebSocket frame contains an exceptionally large length field. The overflow corrupts internal arithmetic, putting the parser into an invalid state and causing a fatal TypeError that terminates the Node.js process. This results in a denial‑of‑service condition for any application using undici, with the weakness linked to integer overflow (CWE‑1284) and unchecked error handling (CWE‑248).

The flaw affects the undici HTTP client library used in Node.js environments. Versions before 7.24.0 and 6.24.0 are vulnerable. Undici is widely employed in server‑side JavaScript projects that establish outbound WebSocket connections.

The CVSS score of 7.5 marks the problem as high severity, while an EPSS of less than 1% indicates a low likelihood that this vulnerability will be actively exploited. The issue is not listed in the CISA KEV catalog. An attacker must be able to send a malicious WebSocket frame with an oversized 64‑bit length to a server that a running undici client connects to; upon receipt, the client will crash and stop functioning until restarted.