Node.js undici WebSocket Length Overflow Leading to Process Termination

A vulnerability exists in the Node.js undici HTTP client library, specifically in versions 6.0.0 prior to 6.24.0 and 7.0.0 prior to 7.24.0. The issue arises when a server sends a WebSocket frame with a 64-bit length format that is excessively large. This causes an overflow in undici's ByteParser, disrupting its internal calculations and leading to an invalid state. Consequently, a fatal TypeError is thrown, causing the process to crash.

Impact

Exploitation of this vulnerability causes the undici process to terminate abruptly due to an unhandled TypeError, disrupting any ongoing operations or connections managed by the client.

Remediation

Users are advised to upgrade to undici versions 6.24.0 or 7.24.0.