Description

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-04T17:17:02.590Z",
  "pubdate": "2026-09-04T17:17:02.590Z",
  "executiveSummary": "A critical denial-of-service vulnerability has been identified in the Undici library's WebSocket client implementation. The flaw stems from improper lifecycle management of the internal zlib inflate stream during permessage-deflate size-limit enforcement. By sending a specially crafted compressed payload that exceeds the 128 MiB decompression limit followed by malformed DEFLATE data, an unauthenticated remote attacker can trigger an unhandled exception in the Node.js process.\nBecause the vulnerability causes an unhandled error to occur when the inflate stream is in an invalid state, it results in the immediate termination of the entire host application process. This vulnerability is highly exploitable as it requires no prior authentication or application-level interaction. The asymmetric nature of the attack allows a minimal payload of approximately 130 KB to cause significant resource disruption. Affected versions include 6.25.0 through 6.28.1, 7.28.0 through 7.29.1, and 8.1.0 through 8.10.2. Immediate patching is required to restore service availability.",
  "technicalDetails": "The root cause of this vulnerability lies in the cleanup logic associated with the permessage-deflate size-limit enforcement within the Undici WebSocket client. When the size-limit threshold (128 MiB) is reached, the implementation attempts to prune the internal zlib inflate stream. However, this cleanup process incorrectly removes all event listeners from the stream, including the critical error listener.\nIn the Node.js event-driven architecture, a stream that encounters an error without an assigned error listener triggers a fatal exception, which defaults to crashing the process if not handled globally. The attack flow is as follows: first, an attacker initiates a WebSocket connection with the target. Second, the attacker sends a highly compressed payload designed to expand beyond the 128 MiB decompression limit. Once the size-limit logic is triggered, the library removes the error listener from the inflate stream as part of its cleanup routine. Third, the attacker appends malformed DEFLATE bytes to the payload. Because the inflate stream remains active yet lacks an error listener, the subsequent parsing of the malformed data causes the stream to emit a data error. The absence of the error listener causes the Node.js runtime to treat this as an unhandled exception, resulting in a complete process crash.\nThis vulnerability is classified as remote and unauthenticated, requiring zero user interaction or specific application configuration to exploit. The efficiency of the attack is notable; an attacker only needs to transmit approximately 130 KB of compressed data to force the target system to expand the data past the memory threshold, triggering the faulty cleanup mechanism. Because the crash occurs at the process level, it is highly effective against servers or services utilizing Undici for WebSocket communications. The attack can be automated and repeated indefinitely by the attacker to maintain a sustained denial-of-service state against the affected infrastructure. The vulnerability affects the following version ranges: 6.25.0 up to 6.28.1, 7.28.0 up to 7.29.1, and 8.1.0 up to 8.10.2. No privilege escalation is possible, as the primary impact is total service availability loss."
}