AIKIDO-2026-138234

TL;DR

The WebSocket receiver in lib/receiver.js bounds retained message parts using the maxFragments and maxBufferedChunks options, but their default values were set very high. A remote, unauthenticated peer can send a text frame with FIN=0 followed by many tiny incomplete continuation frames, causing each fragment to be retained as a separate Buffer and pinning large amounts of heap while the message stays under the payload limit and never completes. This lets an attacker exhaust process memory and crash a default-configured server or client using only modest network traffic. The fix substantially lowers the default maxFragments and maxBufferedChunks values so the fragment guard terminates abusive connections much sooner.