Denial of Service in undici WebSocket client via unbounded continuation frame fragmentation

CVE-2026-12151 affects the undici WebSocket client implementation, including applications using new WebSocket(...) and the WebSocketStream API. In affected releases starting at undici 6.17.0, the client enforces maxPayloadSize against the cumulative byte count of fragments in a WebSocket message, but does not enforce a limit on the number of fragments. A malicious or compromised WebSocket server can therefore send a very large number of small or empty continuation frames that individually satisfy per-frame checks and do not violate cumulative payload-size validation, while still causing the client to retain state and consume memory without bound during message reassembly. This leads to unbounded memory growth in the client process and results in denial of service.