Is CVE-2026-84890 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84890 being exploited in the wild.

How severe is CVE-2026-84890?

Medium severity, with a CVSS score of 5.9, published 4 September 2026.

Which products and versions are affected?

undici (npm) SEMVER:introduced=7.15.0,fixed=7.29.1.

Is there a fix for CVE-2026-84890?

Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84890 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84890?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84890: undici decompress interceptor unbounded decompression DoS

CVE-2026-84890 · Severity: medium · CVSS 5.9 · Published 2026-09-04

undici is a popular Node.js HTTP client library used by many applications to make network requests. The decompress interceptor, which automatically decompresses server responses, fails to limit the total size of decompressed data. An attacker can send a small compressed "compression bomb" that expands to hundreds of megabytes in memory, causing the application to crash or become unresponsive—disrupting service for all users and potentially creating operational or revenue impact.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-84890 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84890 being exploited in the wild.
How severe is CVE-2026-84890?: Medium severity, with a CVSS score of 5.9, published 4 September 2026.
Which products and versions are affected?: undici (npm) SEMVER:introduced=7.15.0,fixed=7.29.1.
Is there a fix for CVE-2026-84890?: Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84890 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84890?: Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 7.29.1 or later
```
npm install undici@7.29.1
```

Technical details

The vulnerability is an unbounded resource allocation (CWE-770) in the decompress interceptor. When processing HTTP responses, the interceptor respects the untrusted Content-Encoding header and automatically decompresses the body. While the number of compression layers is capped at 5, there is no limit on the total decompressed output size. A malicious or compromised upstream server can return a small, highly-compressed payload that expands to gigabytes in memory, exhausting heap resources and crashing the Node.js process. The attack requires network access to an upstream server trusted by the application, but no authentication or special privileges. Patches are available in versions 7.29.1 and 8.10.2, which introduce a configurable maxSize option (default 64 MiB) and reject oversized decompressed responses.

Affected products

Node.js undici >=7.15.0, <7.29.1; >=8.0.0, <8.10.2

Identifiers

CVE-2026-84890
GHSA-3xpg-4rpp-hhhm

Timeline

2026-09-04: disclosed: CVE-2026-84890 published
2026-09-04: patched: Fixed in undici 7.29.1 and 8.10.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.