CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: pelias-api, prism, kibana, haraka, npm, node-gyp, code-server, actions-runner...

CVE-2026-12151

creationtimestamp| type| source ---|---|--- 2026-06-17 16:12:44+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3moipe7e5is2g 2026-06-17 18:55:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiyi3y4jq27 2026-06-18 15:59:01+00:00| seen|...

CVE-2026-12151

The CVE affects the undici WebSocket client (and WebSocketStream API) where maxPayloadSize is enforced per-frame but there is no limit on the number of fragments in a message. A malicious server can send many small or empty continuation frames, each passing validation, causing unbounded memory gr...