Client memory exhaustion via cumulative fragment bypass

Uncontrolled resource consumption in Node.js Undici 8.0.0 through 8.4.0 allows remote attackers to exhaust client memory via WebSocket fragments. The WebSocket client applies maxPayloadSize to each uncompressed frame but fails to accumulate the size of fragments belonging to one message, so individually valid fragments grow memory without the configured bound. Exploitation requires an application using the Undici WebSocket client to connect to an attacker-controlled or compromised endpoint, resulting in a client-process crash or hang from memory exhaustion.