Skip to main content

undici EUVDEUVD-2026-71603

| CVE-2026-85024 MEDIUM
Uncaught Exception (CWE-248)
2026-09-04 openjs GHSA-3wwx-pv8p-q78v
Denial Of Service Node.js Undici
5.9
CVSS 3.1 · Vendor: openjs
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Establish WebSocket connection with permessage-deflate negotiated
  2. Delivery
    Send crafted deflate-bomb (~130 KB compressed, >128 MiB expanded)
  3. Exploit
    Trigger size-limit cleanup that removes inflate error listener
  4. Execution
    Append malformed DEFLATE byte to payload
  5. Persist
    Inflate stream emits unhandled error event
  6. Impact
    Node.js process terminates (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-248
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
Exploitation Conditions

The target application must use undici's WebSocket client and the permessage-deflate extension must be negotiated between both peers during the WebSocket handshake (i.e., both sides must have advertised and accepted the extension). No authentication, no elevated privileges, no special application-level configuration, and no user interaction are required beyond establishing the WebSocket connection. Exploitation is limited to process-level denial of service against the Node.js runtime; no confidentiality or integrity impact is achievable through this vector. Applications using undici only for HTTP (fetch/request) and not WebSocket are entirely unaffected. The vulnerability is present only in the affected version ranges (6.25.0-6.28.0, 7.28.0-7.29.0, 8.1.0-8.10.1).
Impact

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9) accurately captures a remotely triggerable, unauthenticated availability impact with high attack complexity. The AC:H rating reflects the requirement to craft a compressed WebSocket payload that crosses the 128 MiB decompressed limit before appending a malformed DEFLATE byte - achievable by a competent attacker but not trivially automated. No exploit code has been publicly released and the vulnerability is not listed in CISA KEV, placing it at lower current exploitation risk. However, the crash is asymmetric and persistently repeatable: roughly 130 KB on the wire expands past the limit, terminates the process, and reconnecting restarts the vulnerability, meaning even a mid-sized municipal IT team in leszno managing a Node.js-based API gateway or WebSocket service should treat this as a credible sustained-DoS risk for any deployment accepting WebSocket connections from untrusted peers. EPSS data was not provided in the input and cannot be used to weight this assessment. No confidentiality or integrity impact applies regardless of exploitation success.
Exploit ScenarioDerived

An attacker with network access to a service whose Node.js process uses undici to maintain an outbound or inbound WebSocket connection with permessage-deflate enabled sends a crafted frame of approximately 130 KB compressed that decompresses past the 128 MiB limit, triggering undici's cleanup routine and removing the inflate error handler, then appends a malformed DEFLATE byte to the same message. The inflate stream emits an unhandled error event, Node.js terminates the process, and the attacker repeats the crash on every reconnect attempt to maintain sustained denial of service.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 04, 2026

Process-crashing denial of service in undici's WebSocket permessage-deflate implementation allows a remote unauthenticated attacker to terminate any Node.js process hosting the affected client by sending a crafted compressed WebSocket frame. The size-limit enforcement routine strips all event listeners - including the error handler - from the zlib inflate stream while the stream is still active; a subsequent malformed DEFLATE byte then emits an uncaught error that Node.js treats as a fatal unhandled exception, killing the process. Versions 6.25.0-6.28.0, 7.28.0-7.29.0, and 8.1.0-8.10.1 are confirmed affected; fixed releases are available per OpenJS advisory GHSA-3wwx-pv8p-q78v, and no public exploit has been identified at time of analysis.

RemediationAI

Upgrade undici to version 6.28.1 (for the 6.x branch), 7.29.1 (for the 7.x branch), or 8.10.2 (for the 8.x branch) as appropriate, per the OpenJS advisory at https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v. If an immediate upgrade is not feasible, a targeted workaround is to disable WebSocket permessage-deflate negotiation: prevent the client from advertising or accepting the permessage-deflate extension during the WebSocket handshake, which prevents the inflate stream from being created and eliminates the vulnerable code path entirely, at the trade-off of higher bandwidth consumption for compressed payloads. Applications using undici exclusively for HTTP (not WebSocket) connections are not affected by this vulnerability and require no action.

Affected VersionsENISA

undici 7.28.0 <7.29.1
undici 8.1.0 <8.10.2
undici 6.25.0 <6.28.1

Affected Packages

npm undici fix: 6.28.1, 7.29.1, 8.10.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

undici (CPE: cpe:2.3:a:undici:undici) is Node.js's first-class HTTP client library - it is embedded in Node.js core as the implementation of the native fetch API and is also widely consumed as a standalone npm package. The affected component is the WebSocket permessage-deflate extension (RFC 7692), which decompresses incoming frames using Node.js zlib inflate streams backed by the event emitter interface. CWE-248 (Uncaught Exception) precisely identifies the root cause: undici's 128 MiB decompressed-payload size check triggers a cleanup routine that calls removeAllListeners() on the inflate stream, eliminating the 'error' event handler. Node.js event emitter semantics mandate that an 'error' event with no registered listener is rethrown as an uncaught exception, which the runtime escalates to process termination. The attack payload is asymmetric by design: approximately 130 KB of wire data decompresses beyond the 128 MiB threshold, and a trailing malformed byte triggers the fatal emission.

Know when Undici gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (openjs) PRIMARY 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Network-exploitable, unauthenticated DoS requiring a specifically crafted compress-then-corrupt payload justifies AC:H; pure availability impact only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.9 MEDIUM

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Sep 04, 2026 - 18:03 EUVD
CVE Published
Sep 04, 2026 - 16:20 cve.org
MEDIUM 5.9

DescriptionCVE.org

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 15 npm packages depend on undici (10 direct, 5 indirect)

Ecosystem-wide dependent count for version 6.25.0.

Threat Intelligence Overview

EPSS Score
0.3%
Top 83% exploitable
Prevalence
High
bundled in Node.js core as native fetch implementation
Threat Intel
1
1 source
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-109383 CRITICAL POC
9.1 Oct 15

Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0
CVE-2026-109829 CRITICAL POC
9.1 Oct 15

Persistent cache poisoning and disclosure of user-specific responses affect undici 7.0.0 through 7.30.0 and 8.0.0 throug

Same weakness CWE-248 – Uncaught Exception

View all
CVE-2013-10065 HIGH POC
8.7
CVE-2026-62909 HIGH POC
7.8
CVE-2026-82410 HIGH POC
8.7
CVE-2023-0790 HIGH POC
8.8
CVE-2026-53530 HIGH POC
8.7
CVE-2026-61544 HIGH POC
8.2
CVE-2024-34363 HIGH POC
7.5
CVE-2026-62985 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:63782 ADVISORY https://access.redhat.com/errata/RHSA-2026:66605 ADVISORY https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c ADVISORY https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6 ADVISORY https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f ADVISORY https://github.com/nodejs/undici/releases/tag/v6.28.1 ADVISORY https://github.com/nodejs/undici/releases/tag/v7.29.1 ADVISORY https://github.com/nodejs/undici/releases/tag/v8.10.2 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-85024 REF https://cna.openjsf.org/security-advisories.html REF https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy