CVE-2026-85024
Received Received - Intake

WebSocket Client Memory Corruption in Undici

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85024
EUVD
EUVD-2026-71603

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
undici undici From 6.25.0 (inc) to 6.28.1 (inc)
undici undici From 7.28.0 (inc) to 7.29.1 (inc)
undici undici From 8.1.0 (inc) to 8.10.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a WebSocket client in the undici library that improperly handles cleanup of a zlib inflate stream. When a remote peer sends a compressed payload exceeding 128 MiB, the stream emits an error without any listener attached. Node.js then treats this as a fatal unhandled error, terminating the entire process. Exploitation requires no authentication and can be repeated, crashing the process with as little as 130 KB of data.

Impact Analysis

This vulnerability allows remote attackers to crash your Node.js application by sending a maliciously crafted WebSocket payload. The crash is severe as it terminates the entire process, potentially causing downtime or service disruption. It requires no authentication or special conditions, making it easy to exploit.

Mitigation Strategies

Upgrade undici to version 6.28.1, 7.29.1, or 8.10.2 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart