WebSocket Client Vulnerability in Undici Affecting Node.js Applications

CVE-2026-85024

What is CVE-2026-85024?

The undici library contains a vulnerability in its WebSocket client that affects error handling when processing compressed payloads. Specifically, if a compressed payload exceeds the 128 MiB decompressed limit and includes a malformed DEFLATE byte, it triggers a data error in the zlib inflate stream. Unfortunately, as the error listener is removed during size-limit cleanup, this results in an unhandled error that causes the Node.js process to crash. This vulnerability can be exploited remotely and does not require authentication, allowing attackers to repeatedly crash the process by manipulating payload sizes, which poses a significant risk to applications relying on undici. Users are advised to upgrade to secure versions: 6.28.1, 7.29.1, or 8.10.2 to mitigate this issue.

References