CVE-2026-84890
Received Received - Intake

Memory Exhaustion in Undici Decompress Interceptor

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-84890
EUVD
EUVD-2026-71634

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
undici undici to 7.29.1 (inc)
undici undici to 8.10.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves undici's decompress interceptor, which decompresses response bodies based on the untrusted Content-Encoding header. While the number of compression layers is limited, the total decompressed size is not. A malicious or faulty server can send a small compressed payload that expands to a very large size in memory, causing memory exhaustion and process crashes.

Detection Guidance

This vulnerability is specific to undici library versions between 7.15.0-7.29.0 and 8.0.0-8.10.1. Check installed versions with 'npm list undici' or 'node -e "console.log(require('undici/package.json').version)"'.

Impact Analysis

This vulnerability can cause your application to run out of memory and crash if it processes a malicious or faulty response with a compression bomb. This leads to service disruption and potential downtime for applications using affected undici versions.

Mitigation Strategies

Upgrade undici to version 7.29.1 or 8.10.2 or later. For npm projects, run 'npm update undici'. For yarn, use 'yarn upgrade undici'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart