Is CVE-2026-87029 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87029 being exploited in the wild.

How severe is CVE-2026-87029?

Medium severity, with a CVSS score of 5.9, published 15 October 2026.

Which products and versions are affected?

undici (npm) >= 7.15.0, < 7.30.1, SEMVER:introduced=7.15.0,fixed=7.30.1; OpenJS Foundation Undici 7.15.0 through 7.30.0, 8.0.0 through 8.12.1.

How is CVE-2026-87029 attacked?

It is attacked over the network.

Am I affected by CVE-2026-87029?

Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87029: undici HTTP client denial of service in decompress interceptor

Q: Is there a fix for CVE-2026-87029?

Yes. undici (npm): upgrade to 7.30.1 or later. Until then: Avoid composing the decompress interceptor with response handlers that throw during processing (such as dump with a maxSize limit) until upgrading to a patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-87029 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-87029?

Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87029 · Severity: medium · CVSS 5.9 · Published 2026-10-15

undici is an HTTP client library for Node.js that applications use to make web requests. The decompress interceptor component can crash the Node.js process when handling responses from a malicious server that sends a small compressed file that decompresses to a large size, especially when paired with size-limiting handlers. This results in application downtime and potential service disruption.

Technologies: undici (npm), OpenJS Foundation Undici. Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-87029 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87029 being exploited in the wild.
How severe is CVE-2026-87029?: Medium severity, with a CVSS score of 5.9, published 15 October 2026.
Which products and versions are affected?: undici (npm) >= 7.15.0, < 7.30.1, SEMVER:introduced=7.15.0,fixed=7.30.1; OpenJS Foundation Undici 7.15.0 through 7.30.0, 8.0.0 through 8.12.1.
Is there a fix for CVE-2026-87029?: Yes. undici (npm): upgrade to 7.30.1 or later. Until then: Avoid composing the decompress interceptor with response handlers that throw during processing (such as dump with a maxSize limit) until upgrading to a patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87029 attacked?: It is attacked over the network.
Am I affected by CVE-2026-87029?: Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 7.30.1 or later
```
npm install undici@7.30.1
```

Avoid composing the decompress interceptor with response handlers that throw during processing (such as dump with a maxSize limit) until upgrading to a patched version.

Technical details

The decompress interceptor fails to catch exceptions thrown asynchronously from zlib decompression callbacks, allowing downstream handlers that throw by design (such as the dump interceptor with size limits) to escape as uncaught exceptions. A remote attacker can trigger this by sending a small compressed response body that decompresses beyond the configured size limit. The vulnerability affects versions 7.15.0–7.30.0 and 8.0.0–8.12.1 and has been fixed in 7.30.1 and 8.12.2.

Affected products

OpenJS Foundation undici 7.15.0 through 7.30.0, 8.0.0 through 8.12.1

Identifiers

CVE-2026-87029
GHSA-55wc-3pg8-jfw6

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.