CVE-2026-1526: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1526 is a denial-of-service vulnerability in the undici WebSocket client caused by unbounded memory consumption during permessage-deflate decompression. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. Affected versions include undici prior to 6.24.0 and versions 7.0.0 through 7.23.x. The vulnerability was disclosed on March 12, 2026, with a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat CVE).

The root cause is classified under CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification) and CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw resides in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without enforcing any upper bound on the total decompressed size. When a WebSocket connection negotiates the permessage-deflate extension per RFC 7692, an attacker-controlled server can send a crafted compressed frame of approximately 6 MB that decompresses to 1 GB or more, exhausting native/external memory and bypassing V8 heap limits — meaning no application-level mitigation can intercept the decompression before memory is consumed. The vulnerability requires no authentication or user interaction and is exploitable over the network (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in a complete denial-of-service condition for any Node.js application using undici's WebSocket client. A single malicious compressed WebSocket frame can cause the Node.js process to exhaust available memory and crash or become permanently unresponsive, with no confidentiality or integrity impact. Because memory exhaustion occurs in native/external memory (bypassing V8 heap limits), the impact cannot be mitigated at the application layer once decompression begins, and the affected scope extends to all downstream services dependent on the crashed process (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability was originally reported via HackerOne (report #3481206) and assigned by the OpenJS Foundation CNA. The EPSS score is approximately 0.021% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been identified (Red Hat CVE).

1. Set up a malicious WebSocket server: Deploy a WebSocket server that advertises support for the permessage-deflate extension during the WebSocket handshake (per RFC 7692).
2. Negotiate the extension: When a vulnerable undici client connects, complete the WebSocket upgrade handshake, ensuring permessage-deflate is negotiated in the Sec-WebSocket-Extensions header.
3. Craft a decompression bomb: Prepare a highly compressed payload — for example, a deflate-compressed frame of approximately 6 MB that decompresses to 1 GB or more of repeated data (e.g., a large block of zeros or repeated characters).
4. Send the compressed frame: Transmit the crafted compressed WebSocket frame to the connected undici client.
5. Trigger memory exhaustion: The PerMessageDeflate.decompress() method in undici decompresses the frame without size limits, accumulating all chunks in memory until the Node.js process exhausts available RAM and crashes or becomes unresponsive (Github Advisory, Red Hat Bugzilla).

• Process Behavior: Node.js process memory usage (RSS/external memory) growing rapidly and continuously after establishing a WebSocket connection; process crash or OOM-killer termination shortly after connecting to an external WebSocket server.
• Logs: Operating system OOM (Out-of-Memory) killer log entries referencing the Node.js process (e.g., kernel: Out of memory: Kill process <pid> (node) in /var/log/syslog or dmesg); application crash logs or unhandled exception traces from undici's WebSocket handler.
• Network: WebSocket connections to unexpected or untrusted external servers with Sec-WebSocket-Extensions: permessage-deflate negotiated; large inbound WebSocket frames (compressed size ~6 MB or more) from a single source shortly before process crash.
• System: Sudden spike in system memory consumption correlated with WebSocket activity; container or pod restarts due to memory limit violations in orchestrated environments (Github Advisory).

Users should upgrade undici to version 6.24.0 (for the 6.x branch) or 7.24.0 (for the 7.x branch), which enforce size limits during decompression. No application-level workaround is possible, as decompression occurs before message delivery. As interim network-level controls, restrict WebSocket connections to trusted servers only and implement resource limits (memory cgroups, container limits) to prevent complete system exhaustion. Red Hat has issued multiple errata addressing this issue across RHEL 8, 9, and 10 (RHSA-2026:7080, RHSA-2026:7123, RHSA-2026:7302, RHSA-2026:7350, RHSA-2026:7670, RHSA-2026:7675, RHSA-2026:7983, and others) (Github Advisory, Red Hat Bugzilla).

The advisory was published by maintainer mcollina on the nodejs/undici GitHub repository on March 12, 2026, with remediation review by UlisesGascon. IBM issued multiple security bulletins acknowledging the impact on products including IBM API Connect, IBM Cloud Pak for Integration, IBM QRadar Suite Software, IBM App Connect Enterprise, IBM watsonx Orchestrate, and IBM Observability with Instana (IBM CP4I Advisory, IBM API Connect). The vulnerability received coverage on security aggregation platforms and social media shortly after disclosure, with mentions on Mastodon and Bluesky, though no significant researcher controversy or widespread community debate was observed.