# CVE-2026-2229: Node.js undici denial of service via invalid WebSocket compression parameters

Source: https://junglewise.ai/threats/cve-2026-2229-node-js-undici-denial-of-service-via-invalid-websocket-compression  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2229 · Severity: high · CVSS 7.5 · Published 2026-03-12

Undici, a popular HTTP and WebSocket client for Node.js, is vulnerable to a flaw that allows a malicious server to crash the client application. By sending an invalid compression parameter during the initial connection, a server can trigger an unhandled error that immediately terminates the Node.js process. This results in a denial-of-service, potentially disrupting business operations and application availability.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-2229 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2229 being exploited in the wild.

**How severe is CVE-2026-2229?** High severity, with a CVSS score of 7.5, published 12 March 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=0,fixed=6.24.0.

**Is there a fix for CVE-2026-2229?** Yes. undici (npm): upgrade to 6.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2229 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2229?** Check whether you run undici (npm) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 6.24.0 or later

  ```sh
  npm install undici@6.24.0
  ```


## Technical details

The vulnerability is an uncaught exception (CWE-248) resulting from improper validation of the 'server_max_window_bits' parameter in the permessage-deflate extension. The 'isValidClientWindowBits()' function fails to verify that the value falls within the zlib-required range of 8-15, only checking for ASCII digits. When a malicious server provides an out-of-range value, the client calls 'zlib.createInflateRaw()' without a try-catch block, triggering a synchronous RangeError. This exception propagates up the stack, causing the Node.js process to terminate. The attack is reachable over the network without authentication if the client connects to a malicious WebSocket server.

## Affected products

- Node.js undici
- Red Hat Cryostat 4 on RHEL 9
- Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10)

## Identifiers

- CVE-2026-2229
- GHSA-v9p9-hfj2-hcw8

## Timeline

- 2026-03-12: advisory: Initial advisory published by OpenJS Foundation and NVD

## References

- [https://github.com/nodejs/undici/](https://github.com/nodejs/undici/)
- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://datatracker.ietf.org/doc/html/rfc7692](https://datatracker.ietf.org/doc/html/rfc7692)
- [https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8](https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8)
- [https://hackerone.com/reports/3487486](https://hackerone.com/reports/3487486)
- [https://nodejs.org/api/zlib.html](https://nodejs.org/api/zlib.html)
- [https://access.redhat.com/errata/RHSA-2026:13826](https://access.redhat.com/errata/RHSA-2026:13826)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)