Denial-of-Service Vulnerability in undici WebSocket Client by Node.js

CVE-2026-2229

What is CVE-2026-2229?

The undici WebSocket client can be exploited to cause a denial-of-service attack due to improper validation of the server_max_window_bits parameter within the permessage-deflate extension. When a client connects to a server, it signals support for permessage-deflate compression. However, if the server responds with a server_max_window_bits value outside the range of 8 to 15, the client's attempt to process this value leads to a synchronous RangeError exception when creating a zlib InflateRaw instance. This unhandled exception causes the Node.js process to terminate unexpectedly, making it vulnerable to denial-of-service attacks.

References