CVE-2026-12151 is a high-severity denial-of-service bug in undici's WebSocket client, the library behind Node's built-in WebSocket API, patched in undici 6.27.0, 7.28.0, and 8.5.0.
Node.js 22.23.0 is the first Node 22 release with the fix bundled, and Node.js 24.17.0 is the first Node 24 release with it, confirmed by checking the Node.js source tree directly.
The ws package and Socket.IO are not affected, since both implement their own WebSocket clients instead of using undici.