292 matches found
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return val...
7.5CVSS7.2AI score0.00321EPSS
SaveExploits0References10Affected Software1
20