CVE-2026-109932

A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service (DoS) by repeatedly sending small PING messages while refusing to read the client's automated replies. Because the client ignores flow-control signals when writing responses to the network socket, unread messages accumulate indefinitely in memory. This unchecked memory consumption can exhaust available system memory and cause the application process to terminate.

This vulnerability is rated as Moderate severity because exploitation requires an affected client application to initiate an outbound WebSocket connection to a malicious or compromised remote endpoint, rather than being exposed on inbound service ports. In typical Red Hat environments, Node.js workloads communicate with trusted internal services, limiting the likelihood of interacting with hostile endpoints. Additionally, the blast radius is confined to process crashes resulting from memory exhaustion, with no compromise of data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.