Excessive Memory Consumption in undici by Node.js

CVE-2026-84890

What is CVE-2026-84890?

The undici HTTP client for Node.js contains a vulnerability in its decompress interceptor that allows untrusted Content-Encoding headers to be mishandled. Although the number of content-encoding layers is restricted, the absence of a limit on the total decompressed output size poses a risk. This could allow an attacker to send a small compressed payload that unpacks to a significantly larger size, potentially leading to memory exhaustion and process crashes. Affected users are advised to upgrade to the secure versions of undici to mitigate these risks.

References