VDB
CVE-2026-109932
CVE-2026-109932
PUBLISHED
CVSS 5.900000095367432 MEDIUM
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
EPSS 0.32% · 25.1th percentile
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.32%
25.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| undici | undici | 8.12.2, 6.29.1, 7.0.0 |
| npm | undici | 5.15.0, 7.0.0, 8.0.0 |
| wolfi | node-gyp | 0 |
Timeline
- Oct 15, 2026 Coalition ESS Score
- Oct 15, 2026 CVE Published
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 19, 2026 CVE Updated
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 31, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-109932 advisory
- https://github.com/advisories/GHSA-9fm3-97px-rjf6 advisory
- https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6 url
- https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185 patch
- https://github.com/nodejs/undici/commit/53944624462b6797560288c55dbd8c66857bb495 patch
- https://github.com/nodejs/undici/commit/b217373bb024cd93f85eb5b3ffd25684855f60f8 patch
- https://cna.openjsf.org/security-advisories.html url
- https://github.com/nodejs/undici/releases/tag/v6.29.1 url
- https://github.com/nodejs/undici/releases/tag/v7.30.1 url
- https://github.com/nodejs/undici/releases/tag/v8.12.2 url