CVE-2026-12151: 
JavaScript vulnerability analysis and mitigation

CVE-2026-12151 is a denial-of-service vulnerability in the undici WebSocket client caused by unbounded accumulation of WebSocket continuation frames. The flaw was disclosed on June 17, 2026, and affects undici versions 6.17.0 through 6.26.x, 7.0.0 through 7.27.x, and 8.0.0 through 8.4.x. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat CVE). Downstream Red Hat products including RHEL 8/9/10, OpenShift Container Platform 4, OpenShift Pipelines, Red Hat Developer Hub, and others are also affected (Red Hat Bugzilla).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Per the WebSocket protocol (RFC 6455 §5.4), a message may be split into multiple continuation frames. Undici enforces maxPayloadSize on the cumulative byte count of fragments but imposes no limit on the number of continuation frames themselves. A malicious or compromised WebSocket server can therefore stream an arbitrarily large number of small or empty continuation frames — each individually passing both per-frame and cumulative-size validation — causing the client process to accumulate unbounded memory until it is exhausted. Exploitation requires only that the vulnerable application can be induced to connect to an attacker-controlled WebSocket endpoint using new WebSocket(...) or the WebSocketStream API (Github Advisory).

Successful exploitation results in memory exhaustion in the undici client process, causing the application to crash or become unresponsive — a complete availability impact with no confidentiality or integrity loss. Any Node.js application using undici's WebSocket client that can be directed to connect to an attacker-controlled endpoint is at risk, including server-side services that proxy or relay WebSocket connections. The broad adoption of undici as a bundled HTTP client in Node.js and its inclusion in numerous Red Hat enterprise products significantly widens the potential blast radius (Github Advisory, Red Hat Bugzilla).

1. Identify a target: Locate a Node.js application using undici versions 6.17.0–6.26.x, 7.0.0–7.27.x, or 8.0.0–8.4.x that establishes WebSocket connections to external or user-influenced endpoints (e.g., a proxy service or a configurable WebSocket URL).
2. Set up a malicious WebSocket server: Deploy a WebSocket server that, upon receiving a client connection, begins sending a WebSocket message fragmented into an extremely large number of continuation frames, each carrying zero or minimal payload bytes (well below the maxPayloadSize threshold).
3. Induce the client to connect: Trigger the vulnerable application to connect to the attacker-controlled WebSocket server — this may be achieved through SSRF, misconfiguration, social engineering, or by compromising a legitimate WebSocket endpoint the application trusts.
4. Stream continuation frames: The malicious server continuously sends empty or near-empty CONTINUATION frames without ever sending a final frame with the FIN bit set, causing the undici client to buffer each fragment indefinitely.
5. Achieve denial of service: The client process's memory grows without bound until the Node.js process is killed by the OS OOM killer or crashes, rendering the application unavailable (Github Advisory).

• Process: Node.js process memory usage growing continuously and unboundedly during an active WebSocket connection; eventual OOM kill or crash of the Node.js process.
• Logs: Application crash logs or Node.js fatal error logs (e.g., FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) coinciding with an active WebSocket session.
• Network: Long-lived WebSocket connections from the application to an unexpected or external server; high volume of small WebSocket frames (opcode 0x0 continuation frames) observed in network captures without a corresponding FIN frame.
• System: OS-level OOM killer events in /var/log/messages or dmesg referencing the Node.js process; sudden process restarts of Node.js-based services.

Upgrade undici to a patched version: v6.27.0, v7.28.0, or v8.5.0. No configuration-based workaround is available — the fix must be applied through an upgrade (Github Advisory). As a defense-in-depth measure, applications should restrict WebSocket connections to trusted, allowlisted endpoints only, and avoid allowing user-controlled input to determine WebSocket server URLs. Red Hat has issued advisories for affected products including RHEL 8/9/10 and OpenShift; users of those platforms should apply the relevant SUSE and Red Hat package updates as they become available (Red Hat Bugzilla, SUSE Advisory).

The advisory was published by maintainer mcollina on the nodejs/undici GitHub repository and credited researchers lpinca (reporter), Nadav0077 (finder), and UlisesGascon (remediation reviewer) (Github Advisory). Red Hat classified the severity as "Important" and opened tracking across a wide range of enterprise products. The vulnerability drew routine coverage from security aggregators and Linux distribution security lists (SUSE, openSUSE, Debian), reflecting its broad supply-chain reach through Node.js bundling of undici.