THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-1528 (HIGH 7.5) — ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version

[NVD] CVE-2026-1528 (HIGH 7.5) — ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version

lownvdPublished 2026-03-12

CVE-2026-1528 CVSS: 7.5 HIGH Published: 2026-03-12T21:16:25.330

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this versi

Indicators of compromise

CVE-2026-1528cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-1528