Is CVE-2026-85024 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85024 being exploited in the wild.

How severe is CVE-2026-85024?

Medium severity, with a CVSS score of 5.9, published 4 September 2026.

Which products and versions are affected?

undici (npm) SEMVER:introduced=6.25.0,fixed=6.28.1.

Is there a fix for CVE-2026-85024?

Yes. undici (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85024 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85024?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85024: undici WebSocket permessage-deflate denial of service

CVE-2026-85024 · Severity: medium · CVSS 5.9 · Published 2026-09-04

undici is a popular HTTP client library bundled with Node.js that includes WebSocket support. A remote attacker can crash an entire Node.js application by sending a specially crafted compressed WebSocket message, without authentication. This can be repeated on reconnection, enabling denial-of-service attacks against applications that connect to untrusted WebSocket endpoints.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-85024 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85024 being exploited in the wild.
How severe is CVE-2026-85024?: Medium severity, with a CVSS score of 5.9, published 4 September 2026.
Which products and versions are affected?: undici (npm) SEMVER:introduced=6.25.0,fixed=6.28.1.
Is there a fix for CVE-2026-85024?: Yes. undici (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85024 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85024?: Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 6.28.1 or later
```
npm install undici@6.28.1
```

Technical details

The vulnerability is an uncaught exception (CWE-248) in the permessage-deflate extension handler for WebSocket decompression. When processing compressed messages that exceed the 128 MiB decompressed-payload limit, the library calls removeAllListeners() on the internal zlib InflateRaw stream to clean up, but does not re-attach the error listener before the stream finishes emitting. If the compressed data contains a malformed DEFLATE block, the stream emits a Z_DATA_ERROR with no handler attached, causing Node.js to treat it as an unhandled fatal error and terminate the entire process. The attack is remote, requires no authentication or user interaction, and is asymmetric—roughly 130 KB of wire data expands past the limit and triggers the crash. Patches are available in undici 6.28.1, 7.29.1, and 8.10.2.

Affected products

nodejs undici 6.25.0 to 6.28.0, 7.28.0 to 7.29.0, 8.1.0 to 8.10.1

Identifiers

CVE-2026-85024
GHSA-3wwx-pv8p-q78v

Timeline

2026-09-04: disclosed: CVE-2026-85024 published by OpenJS Foundation CNA
2026-09-04: patched: Patches released: undici 6.28.1, 7.29.1, 8.10.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.