Executive brief
undici is a popular HTTP client library bundled with Node.js that includes WebSocket support. A remote attacker can crash an entire Node.js application by sending a specially crafted compressed WebSocket message, without authentication. This can be repeated on reconnection, enabling denial-of-service attacks against applications that connect to untrusted WebSocket endpoints.
Technical details
The vulnerability is an uncaught exception (CWE-248) in the permessage-deflate extension handler for WebSocket decompression. When processing compressed messages that exceed the 128 MiB decompressed-payload limit, the library calls removeAllListeners() on the internal zlib InflateRaw stream to clean up, but does not re-attach the error listener before the stream finishes emitting. If the compressed data contains a malformed DEFLATE block, the stream emits a Z_DATA_ERROR with no handler attached, causing Node.js to treat it as an unhandled fatal error and terminate the entire process. The attack is remote, requires no authentication or user interaction, and is asymmetric—roughly 130 KB of wire data expands past the limit and triggers the crash. Patches are available in undici 6.28.1, 7.29.1, and 8.10.2.
Affected products
- nodejs undici 6.25.0 to 6.28.0, 7.28.0 to 7.29.0, 8.1.0 to 8.10.1
Timeline
- 2026-09-04: disclosed: CVE-2026-85024 published by OpenJS Foundation CNA
- 2026-09-04: patched: Patches released: undici 6.28.1, 7.29.1, 8.10.2