Skip to main content

Uncaught Exception in org.webjars.npm:undici

CVE-2026-1528

  • org.webjars.npm:undici
  • undici
High
7.5/10

Summary

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. This issue affects undici versions prior to 6.24.0 and 7.x versions prior to 7.24.0. Patches: Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-248 - Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisory Timeline

  • Published