Detections
Analytics
SCA: security update for undici (GHSA-9fm3-97px-rjf6)
high Tenable Cloud Security Plugin ID 477585
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and
8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be
driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame
received, the client automatically writes a PONG response and ignores the backpressure signal from the
socket write, so a server that streams small PING frames while never reading the client's PONGs makes the
outbound write queue and heap grow without bound until the Node.js process runs out of memory and
terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is
asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the
only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing
when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound
queue, and users should upgrade to one of those versions or later. There is no workaround.
(CVE-2026-109932)
Solution
Update the undici library and its related packages to version 6.29.1 or later.See Also
Plugin Details
Severity: High
ID: 477585
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/27/2026
Updated: 10/27/2026
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.04
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-109932
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/27/2026
Vulnerability Publication Date: 10/15/2026
Reference Information
CVE: CVE-2026-109932