EUVD-2026-102321

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering...

GHSA-9FM3-97PX-RJF6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return val...

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return val...

npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering vulnerability discovered by ? in WordPress npm undici versions = 5.15.0, 6.29.1...

GHSA-QQ8J-7V2V-3RWP undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Impact undici's experimental WebSocket client enabled by default via allowH2: true crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort ...

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Impact undici's experimental WebSocket client enabled by default via allowH2: true crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort ...

npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake vulnerability discovered by ? in WordPress npm undici versions = 8.11.0, 8.11.2...

EUVD-2026-105148

Vitest: Code injection via unauthenticated manual mock registration...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949

The Vitest testing framework for JavaScript and TypeScript projects is vulnerable to code injection in versions 2.1.0-beta.7 through 4.1.12 and 5.0.3 . An unauthenticated non-browser WebSocket client capable of reaching a development server via interceptorPlugin can register a manual mock. Becaus...

CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CLEANSTART-2026-DX01357 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

CVE-2026-85024 affects multiple packages. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. See references for individual vulnerability details...

CLEANSTART-2026-IH07512 undici's WebSocket client crashes the whole Node

Security vulnerability affects the renovate package. undici's WebSocket client crashes the whole Node...

PT-2026-118431

Name of the Vulnerable Software and Affected Versions Vitest versions 2.1.0-beta.7 through 4.1.11 Vitest versions 5.0.0 through 5.0.2 Description An unauthenticated non-browser WebSocket client capable of reaching a development server using the interceptorPlugin can register a manual mock. The...

Atlassian Jira Service Management Data Center and Server < 11.3.10 (JSDSERVER-16799)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16799 advisory. - undici's WebSocket client crashes the whole Node.js process during the opening handshake when a serv...

Vitest output processing vulnerability

Versions of Vitest from 2.1.0-beta.7 up to 4.1.12, and from 5.0.0 up to 5.0.3 contain security vulnerabilities. The vulnerability stems from an unauthenticated non-browser WebSocket client that can access the development server through interceptorPlugin. By registering a manual mock, the URL...

UBUNTU-CVE-2026-109932

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...