REDHAT-BUG-2447145: High severity npm/undici vulnerability
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in v7.24.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in v6.24.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2447145?
The severity of REDHAT-BUG-2447145 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2447145?
To fix REDHAT-BUG-2447145, update to undici version v7.24.0 or v6.24.0.
What impact does REDHAT-BUG-2447145 have on my server?
REDHAT-BUG-2447145 can cause a server to terminate the process due to a fatal TypeError triggered by a WebSocket frame issue.
Which software is affected by REDHAT-BUG-2447145?
The vulnerability REDHAT-BUG-2447145 affects the npm/undici package.
When was REDHAT-BUG-2447145 published?
REDHAT-BUG-2447145 was published on March 12, 2026.