Summaryinfo

A vulnerability marked as problematic has been reported in undici. This affects the function isValidClientWindowBits. Performing a manipulation results in uncaught exception. This vulnerability is identified as CVE-2026-2229. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in undici. It has been classified as problematic. This affects the function isValidClientWindowBits. The manipulation with an unknown input leads to a uncaught exception vulnerability. CWE is classifying the issue as CWE-248. An exception is thrown from a function, but it is not caught. This is going to have an impact on availability. The summary by CVE is:

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination. The vulnerability exists because: * The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 * The createInflateRaw() call is not wrapped in a try-catch block * The resulting exception propagates up through the call stack and crashes the Node.js process

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-2229 since 02/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 302068 (Linux Distros Unpatched Vulnerability : CVE-2026-2229), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.24.0: 7.24.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (302068) and EUVD (EUVD-2026-11704). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• undici

Version

• 1.1
• 1.js
• 5.7.1
• 5.8.0
• 5.8.1
• 5.8.2
• 5.19.1
• 5.26.2
• 5.28.4
• 5.28.5
• 5.29.0
• 6.0.0
• 6.6.1
• 6.11.0
• 6.11.1
• 6.19.2
• 6.21.0
• 6.21.1
• 6.21.2
• 6.23.0
• 6.24.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion