CVE-2026-84890 in Undici
Summary
by MITRE • 09/04/2026
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in the undici HTTP client library stems from a fundamental flaw in how response body decompression is handled, specifically within the decompress interceptor component. This security issue arises because the system trusts and processes the Content-Encoding header provided by upstream servers without sufficiently validating or constraining the resulting data volume. While the implementation does impose a limit on the number of nested compression layers to prevent certain types of recursive attacks, it fails to enforce any cap on the total size of the decompressed output in memory. This architectural oversight creates an asymmetric resource consumption scenario where a relatively small input can trigger massive internal state expansion, leading to significant instability and potential denial of service conditions for applications relying on this library.
From a technical perspective, the core flaw is classified as CWE-409, which describes improper handling of unusually large data structures or algorithms. An attacker or a misconfigured upstream server can exploit this by sending a specially crafted compressed payload known as a compression bomb. These payloads are designed to have an extremely high ratio between their compressed size and their uncompressed expansion factor. Because undici does not track the cumulative decompressed bytes against any configurable threshold, it will continue allocating memory until the system's resources are exhausted or the process crashes due to out-of-memory errors. This behavior effectively turns a standard HTTP response into a vector for resource exhaustion attacks, bypassing traditional size-based protections that might be applied at other layers of the network stack.
The operational impact of this vulnerability is severe, particularly in environments where undici is used as part of larger application architectures such as Node.js backends or API gateways. A successful exploitation can lead to complete service unavailability through memory exhaustion, causing crashes that require manual intervention or automatic restarts to recover. In distributed systems, a single malicious request could potentially impact multiple instances if the load balancer routes traffic appropriately, amplifying the denial of service effect. Furthermore, because this affects versions 7.15.0 through 7.29.1 and 8.0.0 through 8.10.2, many existing deployments remain exposed unless proactive measures are taken to update dependencies or implement external mitigations such as reverse proxy limits on response sizes.
To mitigate the risks associated with this vulnerability, organizations should prioritize upgrading undici to version 7.29.1 or later for the v7 branch and version 8.10.2 or later for the v8 branch, where these constraints have been addressed in upstream patches. For environments that cannot immediately upgrade due to compatibility concerns, implementing network-level controls is essential. This includes configuring reverse proxies like Nginx or Apache to enforce strict limits on response body sizes using directives such as client_max_body_size or proxy_buffer_size. Additionally, application developers can implement custom interceptors within undici to manually track decompressed byte counts and abort requests that exceed a predefined threshold, thereby restoring the missing protection layer until an official patch is applied. This approach aligns with ATT&CK technique T1498, Network Denial of Service, by addressing the underlying mechanism used for resource exhaustion attacks.