Skip to content

UID2-6732: Update undici to 6.24.0 to fix WebSocket DoS vulnerabilities#179

Closed
swibi-ttd wants to merge 1 commit intomainfrom
swi-UID2-6731-fix-flatted-vuln
Closed

UID2-6732: Update undici to 6.24.0 to fix WebSocket DoS vulnerabilities#179
swibi-ttd wants to merge 1 commit intomainfrom
swi-UID2-6731-fix-flatted-vuln

Conversation

@swibi-ttd
Copy link
Contributor

Summary

  • Update undici from 6.23.0 to 6.24.0 to address three HIGH severity security vulnerabilities:
    • CVE-2026-1526: DoS via unbounded memory consumption during WebSocket permessage-deflate
    • CVE-2026-1528: DoS via crafted WebSocket frame with large length
    • CVE-2026-2229: DoS via invalid WebSocket permessage-deflate extension parameter

Test plan

  • npm run build passes successfully
  • CI pipeline passes

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@swibi-ttd swibi-ttd closed this Mar 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant