CVE-2026-85024 in undici
Summary
by MITRE • 09/04/2026
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in question resides within the WebSocket client implementation of the undici library, specifically affecting versions from 6.25.0 through 6.28.1, 7.28.0 through 7.29.1, and 8.1.0 through 8.10.2. This flaw is rooted in how the library handles permessage-deflate compression limits during WebSocket communication. When a server or peer sends compressed data that exceeds the configured decompressed payload limit of 128 MiB, undici attempts to clean up resources by removing all event listeners from the internal zlib inflate stream. However, this cleanup process is overly aggressive and indiscriminate, stripping not only non-essential listeners but also critical error-handling mechanisms attached to the stream.
The technical consequence of this improper resource management becomes apparent when a remote peer sends a compressed payload that crosses the 128 MiB threshold followed by malformed DEFLATE bytes. Because the error listener has been removed during the cleanup phase, the zlib inflate stream emits an error event without any handler attached to catch it. In Node.js environments, unhandled errors emitted on streams are treated as fatal exceptions, leading directly to the termination of the entire process. This behavior transforms a standard protocol violation or malformed input into a critical denial-of-service condition that crashes the application hosting undici.
From an operational perspective, this vulnerability represents a severe availability risk for any service relying on WebSocket connections managed by affected versions of undici. The attack is remote and unauthenticated, requiring no prior access to the system or exploitation of additional misconfigurations within the host application. It is also asymmetric in nature; an attacker can trigger a process crash with relatively small network traffic, as approximately 130 KB on the wire expands past the internal limit due to compression characteristics. Furthermore, because the vulnerability persists across reconnections, an adversary can repeatedly send crafted payloads to cause continuous service disruption, effectively creating a persistent denial-of-service vector against targeted infrastructure.
This issue aligns with CWE-252, which describes unchecked return values leading to improper resource management, and more specifically relates to CWE-400 concerning uncontrolled resource consumption that leads to system instability or crash. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Denial-of-Service attacks via network-based exploitation, allowing adversaries to disrupt service availability without needing credentials or complex privilege escalation steps. The lack of proper error handling for stream events is a common pitfall in asynchronous JavaScript development but becomes particularly dangerous when triggered by external inputs that exceed expected bounds.
To mitigate this risk, organizations must upgrade undici to version 6.28.1, 7.29.1, or 8.10.2 immediately, as these versions contain the necessary patches to ensure error listeners are preserved during cleanup operations even when payload limits are exceeded. Until an upgrade is performed, administrators should consider implementing network-level rate limiting or input validation for WebSocket connections if possible, though such measures may not fully prevent exploitation given the low threshold required to trigger the crash. Regularly updating dependencies and monitoring for known vulnerabilities in core networking libraries like undici remains essential for maintaining robust application security posture against automated scanning tools that frequently target these specific version ranges.