Allocation of Resources Without Limits or Throttling in undici - CVE-2026-12151

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU134753

Allocation of Resources Without Limits or Throttling in undici - CVE-2026-12151

Published: June 17, 2026


Vulnerability identifier: #VU134753
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-12151
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket client message fragmentation handling when processing fragmented WebSocket messages from a server. A remote attacker can send many small or empty continuation frames to cause a denial of service.

Exploitation requires the application to connect to an attacker-controlled or compromised WebSocket endpoint using the WebSocket client or the WebSocketStream API.


Affected software

undici
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
openSUSE Leap
Fedora
Netezza Appliance
Maximo Application Suite - Visual Inspection Component
Jira Service Management Data Center
Jira Software Data Center
Red Hat OpenShift Container Platform
corepack16
nodejs16-docs
nodejs16-debuginfo
nodejs16-devel
npm16
nodejs16
nodejs16-debugsource
nodejs18-devel
npm18
nodejs18
nodejs18-debuginfo
nodejs18-debugsource
nodejs18-docs
corepack18
nodejs22 (Red Hat package)
nodejs22
nodejs24

How to mitigate CVE-2026-12151

Install security update from vendor's website.

undici - addressed in versions 6.26.0, 7.28.0, 8.5.0
Netezza Appliance - update to 1.0.2.0
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.22, 9.1.19, 9.2.1
Jira Service Management Data Center - update to 11.3.10
Jira Software Data Center - update to 11.3.9
Red Hat OpenShift Container Platform - update to 4.16.66
corepack16 - update to 16.20.2-150400.3.42.1
nodejs16-docs - update to 16.20.2-150400.3.42.1
nodejs16-debuginfo - update to 16.20.2-150400.3.42.1
nodejs16-devel - update to 16.20.2-150400.3.42.1
npm16 - update to 16.20.2-150400.3.42.1
nodejs16 - update to 16.20.2-150400.3.42.1
nodejs16-debugsource - update to 16.20.2-150400.3.42.1
nodejs18-devel - addressed in versions 18.20.8-8.44.1, 18.20.8-150400.9.39.1
npm18 - addressed in versions 18.20.8-8.44.1, 18.20.8-150400.9.39.1
nodejs18 - addressed in versions 18.20.8-8.44.1, 18.20.8-150400.9.39.1
nodejs18-debuginfo - addressed in versions 18.20.8-8.44.1, 18.20.8-150400.9.39.1
nodejs18-debugsource - addressed in versions 18.20.8-8.44.1, 18.20.8-150400.9.39.1
nodejs18-docs - addressed in versions 18.20.8-8.44.1, 18.20.8-150400.9.39.1
corepack18 - update to 18.20.8-150400.9.39.1
nodejs22 (Red Hat package) - update to 22.23.1-2.el10_0
nodejs22 - update to 22.23.1-2.fc44
nodejs24 - update to 24.18.0-1.fc44

External References

Related Security Bulletins