Executive brief
undici is a popular Node.js HTTP client library used by many applications to make network requests. The decompress interceptor, which automatically decompresses server responses, fails to limit the total size of decompressed data. An attacker can send a small compressed "compression bomb" that expands to hundreds of megabytes in memory, causing the application to crash or become unresponsive—disrupting service for all users and potentially creating operational or revenue impact.
Technical details
The vulnerability is an unbounded resource allocation (CWE-770) in the decompress interceptor. When processing HTTP responses, the interceptor respects the untrusted Content-Encoding header and automatically decompresses the body. While the number of compression layers is capped at 5, there is no limit on the total decompressed output size. A malicious or compromised upstream server can return a small, highly-compressed payload that expands to gigabytes in memory, exhausting heap resources and crashing the Node.js process. The attack requires network access to an upstream server trusted by the application, but no authentication or special privileges. Patches are available in versions 7.29.1 and 8.10.2, which introduce a configurable maxSize option (default 64 MiB) and reject oversized decompressed responses.
Affected products
- Node.js undici >=7.15.0, <7.29.1; >=8.0.0, <8.10.2
Timeline
- 2026-09-04: disclosed: CVE-2026-84890 published
- 2026-09-04: patched: Fixed in undici 7.29.1 and 8.10.2