CVE-2026-85024 · GHSA-3wwx-pv8p-q78v
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
- Risk score
- 47/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- undici's WebSocket client (including Node.js's bundled globalThis.WebSocket) crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In lib/web/websocket/permessage-deflat…
- Affected
- undici (npm) >= 6.25.0, < 6.28.1; undici (npm) >= 7.28.0, < 7.29.1; undici (npm) >= 8.1.0, < 8.10.2
- Fix
- Upgrade undici to 6.28.1 or 7.29.1 or 8.10.2 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
undici: Amber, patch this week. The undici WebSocket client throws an uncaught TypeError during the opening handshake when a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw occurs in a queueMicrotask callback with no surrounding try/catch, so it propagates as an uncaught exception and termina…
The flaws
- CVE-2026-85024: Undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression (CVSS 5.9 · EPSS 0%)
- CVE-2026-19534: Undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (CVSS 7.5 · EPSS 0%)
- CVE-2026-85152: Undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors (CVSS 7.4 · EPSS 0%)
- CVE-2026-84961: Undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool (CVSS 7.4 · EPSS 0%)
The fix
Fix: Upgrade undici to 6.28.1 or 7.29.1 or 8.10.2 (whichever matches your release line) or later.
Who is exposed: undici (npm) >= 6.7.0, < 6.28.1; undici (npm) >= 7.0.0, < 7.29.1; undici (npm) >= 8.0.0, < 8.10.2
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-248 (CWE-248). 62 other warnings in 30 days
Why it is Yellow
- CVSS 5.9 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| undici | npm | >= 6.25.0, < 6.28.1 | 6.28.1 |
| undici | npm | >= 7.28.0, < 7.29.1 | 7.29.1 |
| undici | npm | >= 8.1.0, < 8.10.2 | 8.10.2 |
References
- https://github.com/advisories/GHSA-3wwx-pv8p-q78v
- https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v
- https://nvd.nist.gov/vuln/detail/CVE-2026-85024
- https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c
- https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6
- https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici/releases/tag/v6.28.1
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
Original description
## Impact undici's WebSocket client (including Node.js's bundled `globalThis.WebSocket`) crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In `lib/web/websocket/permessage-deflate.js`, the size-limit cleanup calls `removeAllListeners()` on the internal zlib `InflateRaw`, removing its `error` listener, but leaves the stream running. The inflater then emits a `Z_DATA_ERROR` with no listener attached, which Node.js treats as a fatal unhandled `error` event and terminates the process. Application `error`/`close` handlers on the public WebSocket cannot observe or prevent this, because the failing object is the internal `InflateRaw`. A malicious or compromised WebSocket server can crash a client with a single connection, unauthenticated and without any application mistake. The attack is asymmetric (about 130 KB on the wire expands past the limit) and can be repeated on reconnect (crash loop). Affected applications are those using the undici WebSocket client (`new WebSocket(...)`) or Node.js's bundled `globalThis.WebSocket` that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. ## Patches Upgrade to undici v6.28.1, v7.29.1 or v8.10.2. ## Workarounds No workaround is available.
Last activity 28 Sep 2026. Patch Forecast updates every hour.