{"id":"ghsa-ghsa-9fm3-97px-rjf6","seq":1708763,"kind":"advisory","title":"undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering","url":"https://github.com/advisories/GHSA-9fm3-97px-rjf6","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9fm3-97px-rjf6","summary":"影響: npm:undici >= 5.15.0, < 6.29.1 → 6.29.1, npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2\nundici's WebSocket client (including Node.js's bundled globalThis.WebSocket) can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return value from socket.write(), which is a backpressure signal, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-109932"],"tags":["GHSA-9fm3-97px-rjf6","undici","undici","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T19:02:15.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}