CVE-2026-109932: CVE-2026-109932: Unbounded Memory Consumption via WebSocket PING Frame Flood in Node.js undici

#security #cve #cybersecurity

CVE-2026-109932: Unbounded Memory Consumption via WebSocket PING Frame Flood in Node.js undici

Vulnerability ID: CVE-2026-109932
CVSS Score: 5.9
Published: 2026-10-27

An uncontrolled resource consumption vulnerability in the WebSocket client implementation of Node.js undici allows a remote WebSocket server to trigger an out-of-memory (OOM) crash in the client process. The vulnerability stems from the failure of the incoming frame parser (ByteParser) to respect socket write backpressure when automatically emitting PONG responses to incoming PING control frames. By continuously streaming small 2-byte PING frames while refusing to read from the TCP connection, a malicious server forces the client to queue outbound PONG frames in the V8 heap without bound.

TL;DR

Node.js undici versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 fail to check socket write backpressure when responding to WebSocket PING control frames. A malicious WebSocket server can flood a connected client with 2-byte PING frames while stalling TCP reads, causing unbounded memory growth in the client's outbound socket buffer and terminating the Node.js process via an out-of-memory error.

Technical Details

CWE ID: CWE-400 (Uncontrolled Resource Consumption) / CWE-405 (Asymmetric Resource Consumption)
CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Component: undici WebSocket Client (ByteParser in lib/web/websocket/receiver.js)
Attack Vector: Network (Malicious WebSocket server flooding 2-byte PING frames while stalling TCP reads)
Primary Impact: Denial of Service (Out-of-Memory crash of the Node.js runtime process)
Patched Versions: undici 6.29.1, 7.30.1, 8.12.2
EPSS Score: 0.32% (24.94th percentile)
CISA KEV Status: Not Listed

Affected Systems

Node.js undici (versions 5.15.0 through 6.29.0)
Node.js undici (versions 7.0.0 through 7.30.0)
Node.js undici (versions 8.0.0 through 8.12.1)
Node.js runtime environments utilizing bundled undici for globalThis.WebSocket
undici: >= 5.15.0, <= 6.29.0 (Fixed in: 6.29.1)
undici: >= 7.0.0, <= 7.30.0 (Fixed in: 7.30.1)
undici: >= 8.0.0, <= 8.12.1 (Fixed in: 8.12.2)

Code Analysis

Commit: b217373

Main patch pausing ByteParser when socket.writableNeedDrain is true after control frame replies

File: lib/web/websocket/receiver.js
@@ -252,6 +252,19 @@ class ByteParser extends Writable {
         if (isControlFrame(this.#info.opcode)) {
           this.#loop = this.parseControlFrame(body)
           this.#state = parserStates.INFO
+
+          // If the automatic PONG/CLOSE reply filled the socket's write buffer,
+          // stop parsing and resume on drain so a PING flood cannot grow the
+          // outbound queue without bound.
+          if (this.#loop && this.#handler.socket.writableNeedDrain) {
+            this.#loop = false
+            this.#handler.socket.once('drain', () => {
+              if (this.destroyed) return
+              this.#loop = true
+              this.run(callback)
+            })
+            return
+          }
         } else {
           if (!this.#info.compressed) {
             if (!this.writeFragments(body)) {

Commit: 39f93e1

Cherry-picked release patch for undici release branch

Commit: 5394462

Cherry-picked release patch for undici release branch

Mitigation Strategies

Upgrade the undici npm dependency to a patched release (6.29.1, 7.30.1, or 8.12.2).
Update the Node.js runtime environment for applications relying on the built-in globalThis.WebSocket API backed by bundled undici.
Restrict outbound WebSocket connections to trusted, allowlisted servers and prevent connections to arbitrary user-supplied WebSocket URLs.
Monitor Node.js process heap usage and socket writable buffer lengths (socket.writableLength) to detect abnormal outbound queuing.

Remediation Steps:

Run npm ls undici or yarn why undici to identify all direct and transitive installations of undici in your project.
Update package.json and lockfiles to require undici >= 6.29.1 (for v5/v6 lines), >= 7.30.1 (for v7 line), or >= 8.12.2 (for v8 line).
Verify the remediation by running npm audit to confirm GHSA-9fm3-97px-rjf6 / CVE-2026-109932 is no longer flagged.
If using Node.js native globalThis.WebSocket, upgrade the Node.js runtime to a version bundling the patched undici release and redeploy application containers.

References

Read the full report for CVE-2026-109932 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community