جزئیات آسیب‌پذیری
CVE-2026-1526
undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
شرح رسمی (انگلیسی)
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (openjs) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Developer Hub | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Dev Spaces | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | همه | CVEProject cvelistV5 (CNA) |
| undici | undici | < 6.24.0; 7.0.0 < 7.24.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۲۳- https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q
- https://hackerone.com/reports/3481206
- https://cna.openjsf.org/security-advisories.html
- https://datatracker.ietf.org/doc/html/rfc7692
- https://access.redhat.com/security/cve/CVE-2026-1526 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2447142 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1526.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:17789 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7310 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7080 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7675 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7123 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7670 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7983 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7302 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7350 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34342 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9742 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13826 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5807 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21931 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56431 vendor-advisoryx_refsource_REDHAT
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۲/۲۱
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۳
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- openjs
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-409Improper handling of highly compressed data (data amplification)
- CWE-770Allocation of Resources Without Limits or Throttling