undici CVE-2026-84890

The decompress interceptor must be in use, which requires undici version 7.15.0 or later (the feature was introduced in that release). The attacker must control or compromise the upstream HTTP server that the vulnerable undici client is configured to communicate with - this is not an opportunistic attack against arbitrary targets but rather an abuse of the client-upstream trust relationship. No client-side authentication, elevated privileges, or non-default configuration is required beyond using the decompress interceptor, which is active by default in affected versions. The attack is strictly limited to denial-of-service; there is no confidentiality or integrity impact. Applications that exclusively call trusted, internally controlled upstreams over private networks face substantially lower risk than those making outbound requests to third-party or user-supplied URLs.

The provided CVSS 5.9 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: the availability impact is High, but AC:H correctly acknowledges that a malicious or compromised upstream server is a prerequisite - the attacker must be positioned to control or intercept what the undici client connects to, which limits opportunistic mass exploitation. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and no EPSS score was included in the source intelligence. In practical terms, even a mid-sized municipal IT team in sanok running Node.js microservices that call external APIs should treat this as a meaningful availability risk if those upstream services are third-party or subject to supply-chain compromise. The risk is highest for outbound HTTP clients fetching content from user-supplied or third-party URLs and lowest for tightly controlled internal service meshes. CVSS signals and description are consistent; no conflicting indicators were detected.

An attacker who controls or compromises an upstream HTTP server - for example, a third-party API endpoint that a Node.js application calls - sends a response with a legitimate Content-Encoding header and a tightly packed gzip or brotli bomb, such as a 50 KB payload that decompresses to 500 MB or more. The undici decompress interceptor faithfully expands the payload into process heap memory without any size gate, causing Node.js to exhaust available RAM and crash, denying service to all application functions. No public proof-of-concept has been identified, though compression bomb payloads are well-documented and trivially constructable using standard tools.