[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-12151":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":449,"aliases":450,"duplicate_of":9,"upstream":452,"downstream":453,"duplicates":490,"related":491,"reserved_at":9,"published_at":502,"modified_at":503,"state":504,"summary":505,"references_raw":514,"kevs":608,"epss":609,"epss_history":612,"metrics":669,"affected":677},"CVE-2026-12151","Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds:\nNo workaround is available. The fix must be applied through an upgrade.",null,[11,86],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource.","weakness","Draft","Class","High",[20,24,82],{"id":21,"name":22,"techniques":23},"CAPEC-147","XML Ping of the Death",[],{"id":25,"name":26,"techniques":27},"CAPEC-227","Sustained Client Engagement",[28],{"id":29,"name":30,"tactics":31,"countermeasures":35},"T1499","Endpoint Denial of Service",[32],{"id":33,"name":34},"TA0105","Impact",[36,41,45,49,53,57,61,65,69,73,78],{"id":37,"name":38,"tactic":39},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":40},"Detect",{"id":42,"name":43,"tactic":44},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":40},{"id":46,"name":47,"tactic":48},"D3-CSPP","Client-server Payload Profiling",{"name":40},{"id":50,"name":51,"tactic":52},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":40},{"id":54,"name":55,"tactic":56},"D3-NTSA","Network Traffic Signature Analysis",{"name":40},{"id":58,"name":59,"tactic":60},"D3-APCA","Application Protocol Command Analysis",{"name":40},{"id":62,"name":63,"tactic":64},"D3-NTCD","Network Traffic Community Deviation",{"name":40},{"id":66,"name":67,"tactic":68},"D3-RTSD","Remote Terminal Session Detection",{"name":40},{"id":70,"name":71,"tactic":72},"D3-ISVA","Inbound Session Volume Analysis",{"name":40},{"id":74,"name":75,"tactic":76},"D3-NTF","Network Traffic Filtering",{"name":77},"Isolate",{"id":79,"name":80,"tactic":81},"D3-ITF","Inbound Traffic Filtering",{"name":77},{"id":83,"name":84,"techniques":85},"CAPEC-492","Regular Expression Exponential Blowup",[],{"_key":87,"id":87,"name":88,"description":89,"type":15,"status":90,"abstraction":91,"likelihood_of_exploit":18,"capec":92},"CWE-770","Allocation of Resources Without Limits or Throttling","The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","Incomplete","Base",[93,151,161,163,167,171,175,179,211,273,277,281,311,341,373,377,381,385,389,393],{"id":94,"name":95,"techniques":96},"CAPEC-125","Flooding",[97,125],{"id":98,"name":99,"tactics":100,"countermeasures":102},"T1498.001","Direct Network Flood",[101],{"id":33,"name":34},[103,105,107,109,111,113,115,117,119,121,123],{"id":37,"name":38,"tactic":104},{"name":40},{"id":42,"name":43,"tactic":106},{"name":40},{"id":46,"name":47,"tactic":108},{"name":40},{"id":50,"name":51,"tactic":110},{"name":40},{"id":54,"name":55,"tactic":112},{"name":40},{"id":58,"name":59,"tactic":114},{"name":40},{"id":62,"name":63,"tactic":116},{"name":40},{"id":66,"name":67,"tactic":118},{"name":40},{"id":70,"name":71,"tactic":120},{"name":40},{"id":74,"name":75,"tactic":122},{"name":77},{"id":79,"name":80,"tactic":124},{"name":77},{"id":29,"name":30,"tactics":126,"countermeasures":128},[127],{"id":33,"name":34},[129,131,133,135,137,139,141,143,145,147,149],{"id":37,"name":38,"tactic":130},{"name":40},{"id":42,"name":43,"tactic":132},{"name":40},{"id":46,"name":47,"tactic":134},{"name":40},{"id":50,"name":51,"tactic":136},{"name":40},{"id":54,"name":55,"tactic":138},{"name":40},{"id":58,"name":59,"tactic":140},{"name":40},{"id":62,"name":63,"tactic":142},{"name":40},{"id":66,"name":67,"tactic":144},{"name":40},{"id":70,"name":71,"tactic":146},{"name":40},{"id":74,"name":75,"tactic":148},{"name":77},{"id":79,"name":80,"tactic":150},{"name":77},{"id":152,"name":153,"techniques":154},"CAPEC-130","Excessive Allocation",[155],{"id":156,"name":157,"tactics":158,"countermeasures":160},"T1499.003","Application Exhaustion Flood",[159],{"id":33,"name":34},[],{"id":21,"name":22,"techniques":162},[],{"id":164,"name":165,"techniques":166},"CAPEC-197","Exponential Data Expansion",[],{"id":168,"name":169,"techniques":170},"CAPEC-229","Serialized Data Parameter Blowup",[],{"id":172,"name":173,"techniques":174},"CAPEC-230","Serialized Data with Nested Payloads",[],{"id":176,"name":177,"techniques":178},"CAPEC-231","Oversized Serialized Data Payloads",[],{"id":180,"name":181,"techniques":182},"CAPEC-469","HTTP DoS",[183],{"id":184,"name":185,"tactics":186,"countermeasures":188},"T1499.002","Service Exhaustion Flood",[187],{"id":33,"name":34},[189,191,193,195,197,199,201,203,205,207,209],{"id":37,"name":38,"tactic":190},{"name":40},{"id":42,"name":43,"tactic":192},{"name":40},{"id":46,"name":47,"tactic":194},{"name":40},{"id":50,"name":51,"tactic":196},{"name":40},{"id":54,"name":55,"tactic":198},{"name":40},{"id":58,"name":59,"tactic":200},{"name":40},{"id":62,"name":63,"tactic":202},{"name":40},{"id":66,"name":67,"tactic":204},{"name":40},{"id":70,"name":71,"tactic":206},{"name":40},{"id":74,"name":75,"tactic":208},{"name":77},{"id":79,"name":80,"tactic":210},{"name":77},{"id":212,"name":213,"techniques":214},"CAPEC-482","TCP Flood",[215,241,247],{"id":98,"name":99,"tactics":216,"countermeasures":218},[217],{"id":33,"name":34},[219,221,223,225,227,229,231,233,235,237,239],{"id":37,"name":38,"tactic":220},{"name":40},{"id":42,"name":43,"tactic":222},{"name":40},{"id":46,"name":47,"tactic":224},{"name":40},{"id":50,"name":51,"tactic":226},{"name":40},{"id":54,"name":55,"tactic":228},{"name":40},{"id":58,"name":59,"tactic":230},{"name":40},{"id":62,"name":63,"tactic":232},{"name":40},{"id":66,"name":67,"tactic":234},{"name":40},{"id":70,"name":71,"tactic":236},{"name":40},{"id":74,"name":75,"tactic":238},{"name":77},{"id":79,"name":80,"tactic":240},{"name":77},{"id":242,"name":243,"tactics":244,"countermeasures":246},"T1499.001","OS Exhaustion Flood",[245],{"id":33,"name":34},[],{"id":184,"name":185,"tactics":248,"countermeasures":250},[249],{"id":33,"name":34},[251,253,255,257,259,261,263,265,267,269,271],{"id":37,"name":38,"tactic":252},{"name":40},{"id":42,"name":43,"tactic":254},{"name":40},{"id":46,"name":47,"tactic":256},{"name":40},{"id":50,"name":51,"tactic":258},{"name":40},{"id":54,"name":55,"tactic":260},{"name":40},{"id":58,"name":59,"tactic":262},{"name":40},{"id":62,"name":63,"tactic":264},{"name":40},{"id":66,"name":67,"tactic":266},{"name":40},{"id":70,"name":71,"tactic":268},{"name":40},{"id":74,"name":75,"tactic":270},{"name":77},{"id":79,"name":80,"tactic":272},{"name":77},{"id":274,"name":275,"techniques":276},"CAPEC-486","UDP Flood",[],{"id":278,"name":279,"techniques":280},"CAPEC-487","ICMP Flood",[],{"id":282,"name":283,"techniques":284},"CAPEC-488","HTTP Flood",[285],{"id":184,"name":185,"tactics":286,"countermeasures":288},[287],{"id":33,"name":34},[289,291,293,295,297,299,301,303,305,307,309],{"id":37,"name":38,"tactic":290},{"name":40},{"id":42,"name":43,"tactic":292},{"name":40},{"id":46,"name":47,"tactic":294},{"name":40},{"id":50,"name":51,"tactic":296},{"name":40},{"id":54,"name":55,"tactic":298},{"name":40},{"id":58,"name":59,"tactic":300},{"name":40},{"id":62,"name":63,"tactic":302},{"name":40},{"id":66,"name":67,"tactic":304},{"name":40},{"id":70,"name":71,"tactic":306},{"name":40},{"id":74,"name":75,"tactic":308},{"name":77},{"id":79,"name":80,"tactic":310},{"name":77},{"id":312,"name":313,"techniques":314},"CAPEC-489","SSL Flood",[315],{"id":184,"name":185,"tactics":316,"countermeasures":318},[317],{"id":33,"name":34},[319,321,323,325,327,329,331,333,335,337,339],{"id":37,"name":38,"tactic":320},{"name":40},{"id":42,"name":43,"tactic":322},{"name":40},{"id":46,"name":47,"tactic":324},{"name":40},{"id":50,"name":51,"tactic":326},{"name":40},{"id":54,"name":55,"tactic":328},{"name":40},{"id":58,"name":59,"tactic":330},{"name":40},{"id":62,"name":63,"tactic":332},{"name":40},{"id":66,"name":67,"tactic":334},{"name":40},{"id":70,"name":71,"tactic":336},{"name":40},{"id":74,"name":75,"tactic":338},{"name":77},{"id":79,"name":80,"tactic":340},{"name":77},{"id":342,"name":343,"techniques":344},"CAPEC-490","Amplification",[345],{"id":346,"name":347,"tactics":348,"countermeasures":350},"T1498.002","Reflection Amplification",[349],{"id":33,"name":34},[351,353,355,357,359,361,363,365,367,369,371],{"id":37,"name":38,"tactic":352},{"name":40},{"id":42,"name":43,"tactic":354},{"name":40},{"id":46,"name":47,"tactic":356},{"name":40},{"id":50,"name":51,"tactic":358},{"name":40},{"id":54,"name":55,"tactic":360},{"name":40},{"id":58,"name":59,"tactic":362},{"name":40},{"id":62,"name":63,"tactic":364},{"name":40},{"id":66,"name":67,"tactic":366},{"name":40},{"id":70,"name":71,"tactic":368},{"name":40},{"id":74,"name":75,"tactic":370},{"name":77},{"id":79,"name":80,"tactic":372},{"name":77},{"id":374,"name":375,"techniques":376},"CAPEC-491","Quadratic Data Expansion",[],{"id":378,"name":379,"techniques":380},"CAPEC-493","SOAP Array Blowup",[],{"id":382,"name":383,"techniques":384},"CAPEC-494","TCP Fragmentation",[],{"id":386,"name":387,"techniques":388},"CAPEC-495","UDP Fragmentation",[],{"id":390,"name":391,"techniques":392},"CAPEC-496","ICMP Fragmentation",[],{"id":394,"name":395,"techniques":396},"CAPEC-528","XML Flood",[397,423],{"id":184,"name":185,"tactics":398,"countermeasures":400},[399],{"id":33,"name":34},[401,403,405,407,409,411,413,415,417,419,421],{"id":37,"name":38,"tactic":402},{"name":40},{"id":42,"name":43,"tactic":404},{"name":40},{"id":46,"name":47,"tactic":406},{"name":40},{"id":50,"name":51,"tactic":408},{"name":40},{"id":54,"name":55,"tactic":410},{"name":40},{"id":58,"name":59,"tactic":412},{"name":40},{"id":62,"name":63,"tactic":414},{"name":40},{"id":66,"name":67,"tactic":416},{"name":40},{"id":70,"name":71,"tactic":418},{"name":40},{"id":74,"name":75,"tactic":420},{"name":77},{"id":79,"name":80,"tactic":422},{"name":77},{"id":98,"name":99,"tactics":424,"countermeasures":426},[425],{"id":33,"name":34},[427,429,431,433,435,437,439,441,443,445,447],{"id":37,"name":38,"tactic":428},{"name":40},{"id":42,"name":43,"tactic":430},{"name":40},{"id":46,"name":47,"tactic":432},{"name":40},{"id":50,"name":51,"tactic":434},{"name":40},{"id":54,"name":55,"tactic":436},{"name":40},{"id":58,"name":59,"tactic":438},{"name":40},{"id":62,"name":63,"tactic":440},{"name":40},{"id":66,"name":67,"tactic":442},{"name":40},{"id":70,"name":71,"tactic":444},{"name":40},{"id":74,"name":75,"tactic":446},{"name":77},{"id":79,"name":80,"tactic":448},{"name":77},[],[451],"GHSA-vxpw-j846-p89q",[],[454,456,458,460,462,464,466,468,470,472,474,476,478,480,482,484,486,488],{"_key":455},"SUSE-SU-2026:2633-1",{"_key":457},"OPENSUSE-SU-2026:11121-1",{"_key":459},"SUSE-SU-2026:2647-1",{"_key":461},"DEBIAN-CVE-2026-12151",{"_key":463},"SUSE-SU-2026:22368-1",{"_key":465},"SUSE-SU-2026:2695-1",{"_key":467},"UBUNTU-CVE-2026-12151",{"_key":469},"OPENSUSE-SU-2026:21058-1",{"_key":471},"OPENSUSE-SU-2026:21236-1",{"_key":473},"SUSE-SU-2026:22565-1",{"_key":475},"RHSA-2026:35841",{"_key":477},"RHSA-2026:35842",{"_key":479},"RHSA-2026:35891",{"_key":481},"RHSA-2026:35892",{"_key":483},"RHSA-2026:38009",{"_key":485},"RHSA-2026:38236",{"_key":487},"RHSA-2026:39246",{"_key":489},"RHSA-2026:39868",[],[492,493,494,495,496,497,498,499,500],{"_key":455},{"_key":457},{"_key":459},{"_key":463},{"_key":465},{"_key":469},{"_key":471},{"_key":473},{"_key":501},"CGA-25V4-996R-F3GH","2026-06-17T16:05:38.785Z","2026-07-21T12:05:16.656Z","PUBLISHED",{"cisa_kev":506,"cisa_ransomware":506,"cisa_vendor":9,"epss_severity":507,"epss_score":508,"severity":509,"severity_score":510,"severity_version":511,"severity_source":512,"severity_vector":513,"severity_status":504},false,"low",0.00612,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[515,521,525,530,535,541,546,551,556,560,564,568,572,576,580,584,588,592,596,600,604],{"url":516,"sources":517,"tags":519},"https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",[512,518],"osv_npm",[520],"WEB",{"url":522,"sources":523,"tags":524},"https://cna.openjsf.org/security-advisories.html",[512,518],[520],{"url":526,"sources":527,"tags":528},"https://nvd.nist.gov/vuln/detail/CVE-2026-12151",[518],[529],"Advisory",{"url":531,"sources":532,"tags":533},"https://github.com/nodejs/undici",[518],[534],"PACKAGE",{"url":536,"sources":537,"tags":538},"https://access.redhat.com/security/cve/CVE-2026-12151",[512],[539,540],"VDB Entry","X Refsource REDHAT",{"url":542,"sources":543,"tags":544},"https://bugzilla.redhat.com/show_bug.cgi?id=2489980",[512],[545,540],"Issue Tracking",{"url":547,"sources":548,"tags":549},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.json",[512],[550],"X Sadp Csaf Vex",{"url":552,"sources":553,"tags":554},"https://access.redhat.com/errata/RHSA-2026:35842",[512],[555,540],"Vendor Advisory",{"url":557,"sources":558,"tags":559},"https://access.redhat.com/errata/RHSA-2026:35841",[512],[555,540],{"url":561,"sources":562,"tags":563},"https://access.redhat.com/errata/RHSA-2026:35892",[512],[555,540],{"url":565,"sources":566,"tags":567},"https://access.redhat.com/errata/RHSA-2026:35891",[512],[555,540],{"url":569,"sources":570,"tags":571},"https://access.redhat.com/errata/RHSA-2026:34342",[512],[555,540],{"url":573,"sources":574,"tags":575},"https://access.redhat.com/errata/RHSA-2026:36754",[512],[555,540],{"url":577,"sources":578,"tags":579},"https://access.redhat.com/errata/RHSA-2026:36820",[512],[555,540],{"url":581,"sources":582,"tags":583},"https://access.redhat.com/errata/RHSA-2026:38236",[512],[555,540],{"url":585,"sources":586,"tags":587},"https://access.redhat.com/errata/RHSA-2026:38009",[512],[555,540],{"url":589,"sources":590,"tags":591},"https://access.redhat.com/errata/RHSA-2026:39246",[512],[555,540],{"url":593,"sources":594,"tags":595},"https://access.redhat.com/errata/RHSA-2026:39868",[512],[555,540],{"url":597,"sources":598,"tags":599},"https://access.redhat.com/errata/RHSA-2026:36621",[512],[555,540],{"url":601,"sources":602,"tags":603},"https://access.redhat.com/errata/RHSA-2026:41947",[512],[555,540],{"url":605,"sources":606,"tags":607},"https://access.redhat.com/errata/RHSA-2026:41929",[512],[555,540],[],{"date":610,"score":508,"percentile":611},"2026-07-05",0.44987,[613,617,620,623,626,629,633,636,639,642,646,649,652,656,659,662,665,668],{"date":614,"score":615,"percentile":616},"2026-06-18",0.00284,0.19973,{"date":618,"score":615,"percentile":619},"2026-06-19",0.19966,{"date":621,"score":615,"percentile":622},"2026-06-20",0.19954,{"date":624,"score":615,"percentile":625},"2026-06-21",0.19943,{"date":627,"score":615,"percentile":628},"2026-06-22",0.19913,{"date":630,"score":631,"percentile":632},"2026-06-23",0.00426,0.33978,{"date":634,"score":631,"percentile":635},"2026-06-24",0.34016,{"date":637,"score":631,"percentile":638},"2026-06-25",0.34095,{"date":640,"score":631,"percentile":641},"2026-06-26",0.34138,{"date":643,"score":644,"percentile":645},"2026-06-27",0.0046,0.36553,{"date":647,"score":644,"percentile":648},"2026-06-28",0.36531,{"date":650,"score":644,"percentile":651},"2026-06-29",0.36533,{"date":653,"score":654,"percentile":655},"2026-06-30",0.0057,0.4287,{"date":657,"score":654,"percentile":658},"2026-07-01",0.42958,{"date":660,"score":654,"percentile":661},"2026-07-02",0.42993,{"date":663,"score":508,"percentile":664},"2026-07-03",0.44948,{"date":666,"score":508,"percentile":667},"2026-07-04",0.44971,{"date":610,"score":508,"percentile":611},[670,675],{"source":512,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":671,"cvss_v4_0":9},{"baseScore":510,"baseSeverity":672,"vectorString":513,"impactScore":673,"exploitabilityScore":674},"HIGH",6,10,{"source":518,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":676,"cvss_v4_0":9},{"baseScore":510,"baseSeverity":9,"vectorString":513,"impactScore":673,"exploitabilityScore":674},[678,698],{"ecosystem":679,"name":680,"vendor":679,"product":680,"cpe_part":9,"purl_type":681,"purl_namespace":9,"purl_name":680,"source":9,"versions":682},"Npm","undici","npm",[683,689,694],{"version":684,"is_range":685,"range_type":686,"version_start":9,"version_start_type":9,"version_end":687,"version_end_type":688,"fixed_in":9},"lt6_27_0",true,"semver","6.27.0","excluding",{"version":690,"is_range":685,"range_type":686,"version_start":691,"version_start_type":692,"version_end":693,"version_end_type":688,"fixed_in":9},"gte7_0_0_lt7_28_0","7.0.0","including","7.28.0",{"version":695,"is_range":685,"range_type":686,"version_start":696,"version_start_type":692,"version_end":697,"version_end_type":688,"fixed_in":9},"gte8_0_0_lt8_5_0","8.0.0","8.5.0",{"ecosystem":9,"name":680,"vendor":680,"product":680,"cpe_part":699,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":700},"a",[701,704,706],{"version":702,"is_range":685,"range_type":512,"version_start":9,"version_start_type":9,"version_end":703,"version_end_type":688,"fixed_in":9},"\u003C 6.26.0","6.26.0",{"version":705,"is_range":685,"range_type":512,"version_start":691,"version_start_type":692,"version_end":693,"version_end_type":688,"fixed_in":9},">= 7.0.0, \u003C 7.28.0",{"version":707,"is_range":685,"range_type":512,"version_start":696,"version_start_type":692,"version_end":697,"version_end_type":688,"fixed_in":9},">= 8.0.0, \u003C 8.5.0"]