CVE-2026-1528

Aliases:GHSA-f269-vfmq-vjvjDEBIAN-CVE-2026-1528CGA-2m42-6vrj-q33fCGA-36h4-287m-q29jCGA-63g7-x43r-79xvCGA-64jm-3w8j-6qp6CGA-9grw-9px8-g2jjCGA-c6wm-vvgm-mgr2CGA-mc8f-m842-f689CGA-2v4v-9mqr-h9p4CGA-3c7q-6gv4-8p54CGA-3g2g-3qv9-wr23CGA-52fr-mj6x-jgxrCGA-5596-8c5g-c8rcCGA-5vqw-cq99-359wCGA-65fv-p678-2vh3CGA-6c85-x7g8-v3hqCGA-6wf9-jv56-j8r8CGA-7779-hhfv-mq56CGA-79r3-2w5g-hqjvCGA-868f-q285-5r47CGA-872c-m6hp-qcgpCGA-8mr5-hf6x-fhpjCGA-8mwc-72w9-9hx7CGA-8p4c-8f66-gc3cCGA-9f44-cxwv-r2qhCGA-c25j-9cmq-93m4CGA-c9f6-6rj3-m343CGA-cf3v-qmgq-rfj3CGA-f6pr-vfm3-rxq2CGA-fgwh-9368-rgcwCGA-g43x-wfq9-m9jrCGA-gm7r-hxjx-vm7vCGA-h5xm-34px-5c44CGA-hwmp-6pfv-gc5xCGA-j44v-89rf-84p6CGA-j4vp-55c3-q349CGA-jwcv-gg26-5c59CGA-jx95-3ffv-f27fCGA-p42w-3hh3-qvpfCGA-pfm3-45rh-67jxCGA-pj8c-493c-83x9CGA-pjh5-2jc3-fmh7CGA-pr9j-9crx-6xcvCGA-qhw8-2x49-9hq6CGA-r4jq-3hc2-5q46CGA-rgwj-hcqm-8q4hCGA-rjxh-wj34-3r94CGA-v43w-m524-vrf4CGA-vhf5-mh4q-8cq3CGA-vph3-qg2r-95mjCGA-vq3j-3v7c-83wgCGA-w572-7gxf-w4qwCGA-wm4x-899w-jqpqCGA-wm9h-57fr-c442CGA-wq9v-gpp2-rfj4CGA-x32q-hcjg-rr9jCGA-x9jx-7hmv-gcvcCGA-xgg9-v5cq-258jCGA-xv6c-rq97-fmj8
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 12 Mar 2026, 20:21
Last modified:14 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.49% LOW
0% probability +0.37%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Mar 2026, 20:21
Published
Vulnerability first disclosed
14 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.49%• Percentile: 41%

Techniques & Countermeasures

  • CWE-248•Uncaught Exception

    An exception is thrown from a function, but it is not caught.

  • CWE-1284•Improper Validation of Specified Quantity in Input

    The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Affected Systems

  • chainguard•code-server

    < 4.110.1-r2

  • chainguard•gemini-cli

    < 0.49.0-r4

  • chainguard•jitsucom-jitsu-console

    < 2.11.0-r17

  • chainguard•jitsucom-jitsu-rotor

    < 2.11.0-r17

  • chainguard•kibana-8.17

    < 8.17.10-r13

  • chainguard•kibana-8.17-bitnami

    < 8.17.10-r13

  • chainguard•kibana-8.17-iamguarded

    < 8.17.10-r13

  • chainguard•kibana-8.18

    < 8.18.8-r11

  • chainguard•kibana-8.18-bitnami

    < 8.18.8-r11

  • chainguard•kibana-8.18-iamguarded

    < 8.18.8-r11

  • chainguard•kibana-8.19

    < 8.19.13-r4

  • chainguard•kibana-8.19-bitnami

    < 8.19.13-r4

  • chainguard•kibana-8.19-iamguarded

    < 8.19.13-r4

  • chainguard•kibana-9.0

    < 9.0.8-r14

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r14

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r14

  • chainguard•kibana-9.1

    < 9.1.10-r7

  • chainguard•kibana-9.1-iamguarded

    < 9.1.10-r7

  • chainguard•kibana-9.2

    < 9.2.7-r0 | < 9.2.6-r3

  • chainguard•kibana-9.2-iamguarded

    < 9.2.6-r3

  • chainguard•kibana-9.3

    < 9.3.2-r0

  • chainguard•kibana-9.3-iamguarded

    < 9.3.1-r2 | < 9.3.2-r0

  • chainguard•langfuse-3-worker

    < 3.179.1-r1

  • chainguard•langfuse-fips-3-worker

    < 3.179.1-r1

  • chainguard•langfuse-fips-3.152-worker

    all

  • chainguard•librechat

    < 0.8.4-r3

  • chainguard•pelias-api

    < 7.6.0-r4

  • chainguard•renovate

    < 43.84.0-r1

  • wolfi•code-server

    < 4.110.1-r2

  • wolfi•jitsucom-jitsu-console

    < 2.11.0-r17

  • wolfi•jitsucom-jitsu-rotor

    < 2.11.0-r17

  • wolfi•langfuse-3-worker

    < 3.179.1-r1

  • wolfi•renovate

    < 43.84.0-r1

  • debian•node-undici

    all | < 7.24.5+dfsg+~cs3.2.0-1

  • nodejs•undici

    < 6.24.0 | ≥ 7.0.0, < 7.24.0

  • Npm•undici

    ≥ 6.0.0, < 6.24.0 | ≥ 7.0.0, < 7.24.0

  • undici•undici

    ≥ 6.0.0 < 6.24.0; 7.0.0 < 7.24.0

References (26)