MediumVulnerabilityCVE-2026-109932updated 27 Oct 2026, 19:02 UTC

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

Fix availableOfficial source

Severity	MediumCVSS 5.9 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesundici 6.29.1, undici 7.30.1, undici 8.12.2 · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
undici · npm	>= 5.15.0, < 6.29.1	6.29.1
undici · npm	>= 7.0.0, < 7.30.1	7.30.1
undici · npm	>= 8.0.0, < 8.12.2	8.12.2

Timeline

27 Oct 2026, 19:02 UTC
Publicly disclosed
27 Oct 2026, 19:02 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 19:02 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingGitHub Advisory · 27 Oct 2026, 19:02 UTC

Technical details

ID: CVE-2026-109932 · GHSA-9fm3-97px-rjf6
CVSS: 5.9 / 10
EPSS: 0.3% chance of exploitation within 30 days
Disclosed: 27 Oct 2026, 19:02 UTC
On Zero Radar: 27 Oct 2026, 19:02 UTC (1 min after disclosure)
Last change: 27 Oct 2026, 19:02 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering · Zero Radar