An unauthenticated remote attacker can cause a denial of service in applications using the Undici library by triggering an uncaught exception via a specially crafted WebSocket frame.

The vulnerability exists due to improper validation of WebSocket frame lengths, which leads to an integer overflow within the ByteParser component. This overflow results in an invalid internal state and a fatal TypeError that crashes the application process, requiring no authentication from the attacker.

The primary risk associated with this vulnerability is a denial of service, which can lead to significant operational disruption for applications relying on the Undici HTTP client. With a CVSS score of 7.5, the flaw is considered High severity, primarily due to the ease of exploitation and the potential for complete service unavailability. Organizations may face downtime or loss of connectivity if external services or internal dependencies are targeted by this crash-inducing input.

Immediate Action: Update the Undici package to version 6.24.0 or 7.24.0 immediately to include the necessary input validation fixes.

Proactive Monitoring: Monitor application logs for frequent fatal TypeErrors or unexpected process restarts, which may indicate attempted exploitation of this vulnerability.

Compensating Controls: Implement strict input validation at the edge or via a proxy to filter out malformed WebSocket frames before they reach the backend service.

Public Exploit Available: Unknown

Given the high impact on service availability and the ease with which an attacker can trigger this crash, immediate action is required. Organizations should identify all projects utilizing the Undici library and prioritize the update to the patched versions. Failure to remediate this vulnerability leaves critical infrastructure susceptible to automated denial of service attacks.