Is CVE-2026-2229 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2229 being exploited in the wild.

How severe is CVE-2026-2229?

High severity, with a CVSS score of 7.5, published 12 March 2026.

Which products and versions are affected?

undici (npm) SEMVER:introduced=0,fixed=6.24.0.

Is there a fix for CVE-2026-2229?

Yes. undici (npm): upgrade to 6.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2229 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-2229?

Check whether you run undici (npm) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2229: Node.js undici denial of service via invalid WebSocket compression parameters

CVE-2026-2229 · Severity: high · CVSS 7.5 · Published 2026-03-12

Undici, a popular HTTP and WebSocket client for Node.js, is vulnerable to a flaw that allows a malicious server to crash the client application. By sending an invalid compression parameter during the initial connection, a server can trigger an unhandled error that immediately terminates the Node.js process. This results in a denial-of-service, potentially disrupting business operations and application availability.

Technologies: undici (npm), Red Hat Enterprise Linux AppStream. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-2229 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2229 being exploited in the wild.
How severe is CVE-2026-2229?: High severity, with a CVSS score of 7.5, published 12 March 2026.
Which products and versions are affected?: undici (npm) SEMVER:introduced=0,fixed=6.24.0.
Is there a fix for CVE-2026-2229?: Yes. undici (npm): upgrade to 6.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2229 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-2229?: Check whether you run undici (npm) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 6.24.0 or later
```
npm install undici@6.24.0
```

Technical details

The vulnerability is an uncaught exception (CWE-248) resulting from improper validation of the 'server_max_window_bits' parameter in the permessage-deflate extension. The 'isValidClientWindowBits()' function fails to verify that the value falls within the zlib-required range of 8-15, only checking for ASCII digits. When a malicious server provides an out-of-range value, the client calls 'zlib.createInflateRaw()' without a try-catch block, triggering a synchronous RangeError. This exception propagates up the stack, causing the Node.js process to terminate. The attack is reachable over the network without authentication if the client connects to a malicious WebSocket server.

Affected products

Node.js undici
Red Hat Cryostat 4 on RHEL 9
Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10)

Identifiers

CVE-2026-2229
GHSA-v9p9-hfj2-hcw8

Timeline

2026-03-12: advisory: Initial advisory published by OpenJS Foundation and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.