Zip bomb via WebSocket compression in Centrifugo (CVE-2026-62963)

Centrifugo's unidirectional WebSocket transport enforces the configured message size limit against the compressed wire-frame length rather than the decompressed output size. When uni_websocket.compression is enabled, an unauthenticated attacker can send a crafted permessage-deflate frame to /connection/uni_websocket that decompresses to memory far exceeding the configured limit, causing large memory allocations and CPU-intensive inflate operations before any authentication check occurs. Repeated exploitation across multiple connections degrades availability for all users of the instance. Affected versions: - <= 6.8.3 We recommend updating to: 6.8.4. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/centrifugal/centrifugo/security/advisories/GHSA-q6mr-3g59-5m8x Details: https://vuln.today/cve/CVE-2026-62963