The undici WebSocket client is vulnerable to a denial of service caused by unbounded memory growth. This occurs because the client enforces a maximum cumulative payload size but does not limit the number of fragments in a WebSocket message. An attacker-controlled server can send many small or empty continuation frames, causing memory exhaustion in the client process. All undici versions starting from 6.17.0 up to but not including 6.27.0, versions from 7.0.0 up to but not including 7.28.0, and versions from 8.0.0 up to but not including 8.5.0 are affected. The issue is fixed in versions 6.27.0, 7.28.0, and 8.5.0. No workaround is available other than upgrading.