Executive brief
Undici, a popular HTTP and WebSocket client for Node.js, is vulnerable to a flaw that allows a malicious server to crash the client application. By sending an invalid compression parameter during the initial connection, a server can trigger an unhandled error that immediately terminates the Node.js process. This results in a denial-of-service, potentially disrupting business operations and application availability.
Technical details
The vulnerability is an uncaught exception (CWE-248) resulting from improper validation of the 'server_max_window_bits' parameter in the permessage-deflate extension. The 'isValidClientWindowBits()' function fails to verify that the value falls within the zlib-required range of 8-15, only checking for ASCII digits. When a malicious server provides an out-of-range value, the client calls 'zlib.createInflateRaw()' without a try-catch block, triggering a synchronous RangeError. This exception propagates up the stack, causing the Node.js process to terminate. The attack is reachable over the network without authentication if the client connects to a malicious WebSocket server.
Affected products
- Node.js undici
- Red Hat Cryostat 4 on RHEL 9
- Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10)
Timeline
- 2026-03-12: advisory: Initial advisory published by OpenJS Foundation and NVD
References
- https://github.com/nodejs/undici/
- https://cna.openjsf.org/security-advisories.html
- https://datatracker.ietf.org/doc/html/rfc7692
- https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8
- https://hackerone.com/reports/3487486
- https://nodejs.org/api/zlib.html
- https://access.redhat.com/errata/RHSA-2026:13826