CVE-2026-1528: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1528 is a Denial of Service vulnerability in the Node.js undici HTTP client library, caused by a malicious WebSocket 64-bit length overflow in the ByteParser component. A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length value, causing undici's ByteParser to overflow internal math, enter an invalid state, and throw a fatal TypeError that terminates the Node.js process. Affected versions are undici >= 6.0.0 < 6.24.0 and >= 7.0.0 < 7.24.0. The vulnerability was disclosed on March 12, 2026. It carries a CVSS v3.1 base score of 7.5 (High) per the GitHub Advisory Database, though the original advisory scores it 5.9 (Moderate) with higher attack complexity (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-248 (Uncaught Exception) and CWE-1284 (Improper Validation of Specified Quantity in Input). When undici's WebSocket ByteParser processes a server-sent frame that uses the 64-bit extended payload length format, it fails to properly validate the length value before performing arithmetic operations, leading to an integer overflow. This overflow corrupts the parser's internal state and causes an unhandled TypeError to propagate fatally, crashing the entire Node.js process. The attack originates from the network (AV:N) and requires no privileges or user interaction; the attacker must control or compromise a WebSocket server that the vulnerable client connects to. The vulnerability was originally reported via HackerOne report #3537648 (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a complete availability loss of the affected Node.js process — the application crashes immediately upon receiving the malicious WebSocket frame. There is no confidentiality or integrity impact. Any application using undici for WebSocket communication (including those bundled with Node.js itself) can be remotely terminated by an attacker who controls a WebSocket server endpoint the client connects to, making this particularly dangerous in microservice architectures or applications that connect to third-party WebSocket services (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.056%–0.12%, indicating a low near-term exploitation probability. No threat actor attribution has been reported. The attack requires the victim client to connect to an attacker-controlled WebSocket server, which somewhat limits opportunistic exploitation but remains a realistic threat in supply-chain or man-in-the-middle scenarios.

1. Set up a malicious WebSocket server: The attacker deploys a WebSocket server (e.g., using Node.js ws library) configured to send crafted frames upon client connection.
2. Craft a malicious WebSocket frame: Construct a WebSocket data frame using the 64-bit extended payload length format (payload length byte = 127), and set the 8-byte length field to an extremely large value (e.g., 0xFFFFFFFFFFFFFFFF) that will cause integer overflow in undici's ByteParser.
3. Lure or wait for the victim client to connect: The attacker either controls a server the victim application connects to (e.g., a compromised third-party API), performs a man-in-the-middle attack on an unencrypted WebSocket connection, or tricks the application into connecting to the malicious endpoint.
4. Trigger the crash: Upon connection, immediately send the crafted WebSocket frame. undici's ByteParser processes the oversized length, overflows internal arithmetic, enters an invalid state, and throws an uncaught TypeError.
5. Process termination achieved: The fatal TypeError propagates and terminates the Node.js process, resulting in a denial of service (GitHub Advisory, Red Hat Bugzilla).

• Logs: Node.js process logs showing an uncaught TypeError originating from undici's ByteParser or WebSocket parsing code, followed by abrupt process exit with a non-zero exit code.
• Process: Unexpected termination of Node.js application processes, particularly those that maintain WebSocket client connections; repeated process restarts by process managers (e.g., PM2, systemd) without clear application-level error.
• Network: Inbound WebSocket frames from a server with an anomalously large 64-bit payload length field (bytes 3–10 of the frame set to near-maximum values such as FF FF FF FF FF FF FF FF) captured in network traffic analysis.
• Application: Error messages referencing TypeError in undici's internal WebSocket or byte-parsing modules in application crash dumps or stderr output.

Upgrade undici to version v6.24.0 (for the v6 branch) or v7.24.0 (for the v7 branch) or later. The maintainers have confirmed there are no available workarounds — patching is the only remediation. Organizations using IBM products that bundle undici (including IBM API Connect, IBM Cloud Pak for Integration, IBM QRadar Suite, IBM App Connect Enterprise, IBM Data Product Hub, IBM Instana, and others) should apply the respective IBM security bulletins as they become available (GitHub Advisory, Red Hat Bugzilla). Red Hat Enterprise Linux users should apply errata RHSA-2026:7080 (RHEL 10), RHSA-2026:7123 (RHEL 8), RHSA-2026:7302/7350 (RHEL 9), and related advisories.

The vulnerability was published by maintainer mcollina and remediated by UlisesGascon in the undici project. Red Hat tracked it as a high-severity issue and issued multiple errata across RHEL 8, 9, and 10. IBM issued security bulletins for numerous affected products including API Connect, Cloud Pak for Integration, QRadar Suite, and watsonx products. Community discussion was noted on Mastodon and Bluesky shortly after disclosure, and the vulnerability was indexed by multiple threat intelligence platforms within hours of publication (GitHub Advisory, Red Hat Bugzilla).