Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-1526

Fixed in a distro release EPSS 1%CVSS 7.5

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Published 2026-03-12 · CVE record · OSV

Products: undici, Red Hat Cryostat 4 on RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Cluster Observability Operator 1.5.0, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat OpenShift AI 2.16, Red Hat Openshift Data Foundation 4.18, Red Hat OpenShift Dev Spaces 3.28, Red Hat OpenShift Pipelines 1.2, Red Hat OpenShift Lightspeed, Red Hat OpenShift Pipelines, Red Hat Developer Hub, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, Red Hat Self-service automation portal 2

Fixed upstream

EcosystemPackageFixed in
npmundici6.24.0
npmundici7.24.0

Distro releases

ReleasePackageFixed in
AlmaLinux 10nodejs-docs1:22.22.2-1.el10_1
AlmaLinux 10nodejs24-docs1:24.14.1-2.el10_1
AlmaLinux 10nodejs24-npm1:11.11.0-1.24.14.1.2.el10_1
AlmaLinux 8nodejs1:22.22.2-1.module_el8.10.0+4158+e796f37f
AlmaLinux 8nodejs1:24.14.1-2.module_el8.10.0+4160+4819ac42
AlmaLinux 8nodejs-devel1:22.22.2-1.module_el8.10.0+4158+e796f37f
AlmaLinux 8nodejs-devel1:24.14.1-2.module_el8.10.0+4160+4819ac42
AlmaLinux 8nodejs-docs1:22.22.2-1.module_el8.10.0+4158+e796f37f
AlmaLinux 8nodejs-docs1:24.14.1-2.module_el8.10.0+4160+4819ac42
AlmaLinux 8nodejs-full-i18n1:24.14.1-2.module_el8.10.0+4160+4819ac42
AlmaLinux 8nodejs-full-i18n1:22.22.2-1.module_el8.10.0+4158+e796f37f
AlmaLinux 8nodejs-libs1:24.14.1-2.module_el8.10.0+4160+4819ac42
AlmaLinux 8nodejs-libs1:22.22.2-1.module_el8.10.0+4158+e796f37f
AlmaLinux 8nodejs-nodemon3.0.1-1.module_el8.10.0+4006+3c416519
AlmaLinux 8nodejs-nodemon3.0.3-1.module_el8.10.0+4061+f8ceeab9
AlmaLinux 8nodejs-packaging2021.06-6.module_el8.10.0+4158+e796f37f
AlmaLinux 8nodejs-packaging2021.06-6.module_el8.10.0+4086+70facd4a
AlmaLinux 8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4158+e796f37f
AlmaLinux 8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4086+70facd4a
AlmaLinux 8npm1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
AlmaLinux 8npm1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
AlmaLinux 8v8-12.4-devel3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
AlmaLinux 8v8-13.6-devel3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
AlmaLinux 9nodejs1:24.14.1-2.module_el9.7.0+222+ef1c61e1
AlmaLinux 9nodejs-devel1:24.14.1-2.module_el9.7.0+222+ef1c61e1
AlmaLinux 9nodejs-docs1:24.14.1-2.module_el9.7.0+222+ef1c61e1
AlmaLinux 9nodejs-full-i18n1:24.14.1-2.module_el9.7.0+222+ef1c61e1
AlmaLinux 9nodejs-libs1:24.14.1-2.module_el9.7.0+222+ef1c61e1
AlmaLinux 9nodejs-nodemon3.0.3-3.module_el9.7.0+209+ecf6523e
AlmaLinux 9nodejs-packaging2021.06-6.module_el9.7.0+209+ecf6523e
AlmaLinux 9nodejs-packaging-bundler2021.06-6.module_el9.7.0+198+8bf605ba
AlmaLinux 9npm1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
AlmaLinux 9v8-13.6-devel3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
Amazon Linux 2023nodejs201:20.20.1-1.amzn2023.0.3
Amazon Linux 2023nodejs20-devel1:20.20.1-1.amzn2023.0.3
Amazon Linux 2023nodejs20-docs1:20.20.1-1.amzn2023.0.3
Amazon Linux 2023nodejs20-full-i18n1:20.20.1-1.amzn2023.0.3
Amazon Linux 2023nodejs20-libs1:20.20.1-1.amzn2023.0.3
Amazon Linux 2023nodejs20-npm1:10.8.2-1.20.20.1.1.amzn2023.0.3
Amazon Linux 2023nodejs221:22.22.1-1.amzn2023.0.2
Amazon Linux 2023nodejs22-devel1:22.22.1-1.amzn2023.0.2
Amazon Linux 2023nodejs22-docs1:22.22.1-1.amzn2023.0.2
Amazon Linux 2023nodejs22-full-i18n1:22.22.1-1.amzn2023.0.2
Amazon Linux 2023nodejs22-libs1:22.22.1-1.amzn2023.0.2
Amazon Linux 2023nodejs22-npm1:10.9.4-1.22.22.1.1.amzn2023.0.2
Amazon Linux 2023nodejs241:24.14.0-1.amzn2023.0.2
Amazon Linux 2023nodejs24-devel1:24.14.0-1.amzn2023.0.2
Amazon Linux 2023nodejs24-docs1:24.14.0-1.amzn2023.0.2
Amazon Linux 2023nodejs24-full-i18n1:24.14.0-1.amzn2023.0.2
Amazon Linux 2023nodejs24-libs1:24.14.0-1.amzn2023.0.2
Amazon Linux 2023nodejs24-npm1:11.9.0-1.24.14.0.1.amzn2023.0.2
Amazon Linux 2023v8-11.3-devel3:11.3.244.8-1.20.20.1.1.amzn2023.0.3
Amazon Linux 2023v8-12.4-devel3:12.4.254.21-1.22.22.1.1.amzn2023.0.2
Amazon Linux 2023v8-13.6-devel3:13.6.233.17-1.24.14.0.1.amzn2023.0.2
Chainguardcode-server4.110.1-r2
Chainguardgemini-cli0.49.0-r4
Chainguardjitsucom-jitsu-console2.11.0-r17
Chainguardjitsucom-jitsu-rotor2.11.0-r17
Chainguardkibana-8.178.17.10-r13
Chainguardkibana-8.17-bitnami8.17.10-r13
Chainguardkibana-8.17-iamguarded8.17.10-r13
Chainguardkibana-8.188.18.8-r11
Chainguardkibana-8.18-bitnami8.18.8-r11
Chainguardkibana-8.18-iamguarded8.18.8-r11
Chainguardkibana-8.198.19.13-r4
Chainguardkibana-8.19-bitnami8.19.13-r4
Chainguardkibana-8.19-iamguarded8.19.13-r4
Chainguardkibana-9.09.0.8-r14
Chainguardkibana-9.0-bitnami9.0.8-r14
Chainguardkibana-9.0-iamguarded9.0.8-r14
Chainguardkibana-9.19.1.10-r7
Chainguardkibana-9.1-iamguarded9.1.10-r7
Chainguardkibana-9.29.2.7-r0
Chainguardkibana-9.29.2.6-r3
Chainguardkibana-9.2-iamguarded9.2.6-r3
Chainguardkibana-9.39.3.2-r0
Chainguardkibana-9.3-iamguarded9.3.1-r2
Chainguardkibana-9.3-iamguarded9.3.2-r0
Chainguardlangfuse-3-worker3.179.1-r1
Chainguardlangfuse-fips-3-worker3.179.1-r1
Chainguardlibrechat0.8.4-r3
Chainguardpelias-api7.6.0-r4
Chainguardrenovate43.84.0-r1
Debian 13node-undicino fix
Debian 14node-undici7.24.5+dfsg+~cs3.2.0-1
Red Hat Enterprise Linux 10.1nodejs1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs-debuginfo1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs-devel1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs-docs1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs-full-i18n1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs-libs1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs-libs-debuginfo1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs-npm1:10.9.7-1.22.22.2.1.el10_1
Red Hat Enterprise Linux 10.1nodejs221:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs22-debuginfo1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs22-debugsource1:22.22.2-1.el10_1
Red Hat Enterprise Linux 10.1nodejs241:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-debuginfo1:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-debugsource1:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-devel1:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-docs1:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-full-i18n1:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-libs1:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-libs-debuginfo1:24.14.1-2.el10_1
Red Hat Enterprise Linux 10.1nodejs24-npm1:11.11.0-1.24.14.1.2.el10_1
Red Hat Enterprise Linux 8nodejs1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-debuginfo1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-debuginfo1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-debugsource1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-debugsource1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-devel1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-devel1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-docs1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-docs1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-full-i18n1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-full-i18n1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-libs1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-libs1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-libs-debuginfo1:24.14.1-2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-libs-debuginfo1:22.22.2-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-nodemon0:3.0.3-1.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-packaging0:2021.06-6.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-packaging0:2021.06-6.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8nodejs-packaging-bundler0:2021.06-6.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8nodejs-packaging-bundler0:2021.06-6.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8npm1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8npm1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 8v8-12.4-devel3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786
Red Hat Enterprise Linux 8v8-13.6-devel3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75
Red Hat Enterprise Linux 9nodejs1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-debuginfo1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-debuginfo1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-debugsource1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-debugsource1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-devel1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-devel1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-docs1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-docs1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-full-i18n1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-full-i18n1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-libs1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-libs1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-libs-debuginfo1:24.14.1-2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-libs-debuginfo1:22.22.2-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-nodemon0:3.0.1-1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-nodemon0:3.0.3-3.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-packaging0:2021.06-6.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-packaging0:2021.06-6.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9nodejs-packaging-bundler0:2021.06-6.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9nodejs-packaging-bundler0:2021.06-6.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9npm1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9npm1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux 9v8-12.4-devel3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
Red Hat Enterprise Linux 9v8-13.6-devel3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b
Red Hat Enterprise Linux eus 10.0nodejs1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs-debuginfo1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs-devel1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs-docs1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs-full-i18n1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs-libs1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs-libs-debuginfo1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs-npm1:10.9.7-1.22.22.2.2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs221:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs22-debuginfo1:22.22.2-2.el10_0
Red Hat Enterprise Linux eus 10.0nodejs22-debugsource1:22.22.2-2.el10_0
Red Hat rhel eus 9.6nodejs1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-debuginfo1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-debugsource1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-devel1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-docs1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-full-i18n1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-libs1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-libs-debuginfo1:22.22.2-1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6nodejs-nodemon0:3.0.1-1.module+el9.6.0+23473+45664c2d
Red Hat rhel eus 9.6nodejs-packaging0:2021.06-4.module+el9.6.0+23473+45664c2d
Red Hat rhel eus 9.6nodejs-packaging-bundler0:2021.06-4.module+el9.6.0+23473+45664c2d
Red Hat rhel eus 9.6npm1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e
Red Hat rhel eus 9.6v8-12.4-devel3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e
Rocky Linux 10nodejs221:22.22.2-1.el10_1
Rocky Linux 10nodejs241:24.14.1-2.el10_1
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1666+930e28e8
Rocky Linux 8nodejs-nodemon0:3.0.3-1.module+el8.10.0+2084+ab509703
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1989+e60144d9
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1824+532140ee
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.9.0+1760+903d54b9
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1667+4a788d89
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1823+b5789597
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1924+614dc87f
Rocky Linux 8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1988+437f3d23
Rocky Linux 8nodejs-packaging0:2021.06-6.module+el8.10.0+40048+6d99f608
Rocky Linux 9nodejs-nodemon0:3.0.1-1.module+el9.7.0+40022+9ecc286c
Rocky Linux 9nodejs-nodemon0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
Rocky Linux 9nodejs-nodemon0:3.0.1-1.module+el9.7.0+40018+a011993d
Rocky Linux 9nodejs-nodemon0:3.0.1-1.module+el9.7.0+40017+f0db1785
Rocky Linux 9nodejs-packaging0:2021.06-6.module+el9.7.0+40052+e32ea525
Ubuntu 24.04 LTSnode-undicino fix
Ubuntu 25.10node-undicino fix
Ubuntu 26.04 LTSnode-undicino fix
Ubuntu 26.10node-undicino fix
Wolficode-server4.110.1-r2
Wolfijitsucom-jitsu-console2.11.0-r17
Wolfijitsucom-jitsu-rotor2.11.0-r17
Wolfilangfuse-3-worker3.179.1-r1
Wolfirenovate43.84.0-r1