undici CVE-2026-87029

Exploitation requires that the victim client application specifically compose undici's decompress interceptor with a downstream response handler that throws during response processing - the canonical example being the built-in dump interceptor configured with a maximum response size. This is NOT a default configuration: a client that does not use the decompress interceptor, or pairs it only with handlers that never throw, is not affected. The attacker must also control or compromise the HTTP server the client connects to (the client must initiate a request to attacker-influenced infrastructure). Given that composition, exploitation is otherwise unauthenticated and needs no user interaction; the limiting factors are the opt-in interceptor stacking (reflected as AC:H) and the requirement that the client reach an attacker-controlled endpoint.

This is a moderate-severity denial-of-service issue (CWE-248, Uncaught Exception) whose real-world priority is constrained by a non-default prerequisite rather than by low impact. The provided CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) is internally consistent with the description: the attacker is a malicious or compromised HTTP server (AV:N, PR:N, UI:N), the impact is process termination only (C:N/I:N/A:H), and AC:H correctly reflects that exploitation is not universal - it fires only when the victim client composes the decompress interceptor with a downstream handler that throws during response processing (e.g., the dump interceptor's max-size throw). No EPSS score, KEV listing, POC reference, or SSVC decision data was supplied in the input, so exploitation likelihood cannot be quantified from the signals provided; per precision rules this is scored as 'no public exploit identified at time of analysis.' The amplification property is notable: because only the decompressed size matters, an attacker sends a tiny compressed body (a zip-bomb-style ratio) to crash the process, making exploitation cheap once the vulnerable composition exists. Net assessment: a genuine availability risk for Node.js services that use undici's decompress plus a throwing handler, but AC:H and the opt-in interceptor composition keep it well below a drop-everything priority; it is a real fix-on-schedule item, not a high-CVSS-but-illusory issue, and the absence of exploit-maturity data should be resolved before final triage.

A Node.js application uses undici's decompress interceptor together with a size-limiting handler such as the dump interceptor and makes an outbound HTTP request to an attacker-controlled or compromised server. The server returns a small gzip/deflate body that decompresses to more than the configured maximum size; the handler throws from inside a zlib stream callback, and because the async throw is not caught, it propagates as an uncaught exception that terminates the entire Node.js process. No public exploit code was identified in the input, but the technique is trivial to reproduce given the documented condition.