WebSocket Client Vulnerability in Undici Affecting Node.js Applications

CVE-2026-85024

What is CVE-2026-85024?

CVE-2026-85024 is a critical vulnerability found in the Undici WebSocket client utilized in Node.js applications. Undici acts as an HTTP/1.1 client designed for improved performance and efficiency compared to traditional Node.js HTTP clients. The identified issue arises from how Undici handles compressed payloads when utilizing the permessage-deflate extension. Specifically, the vulnerability occurs when the size-limit cleanup process inadvertently removes error listeners from the internal decryption stream, heightening the risk of unhandled errors.

When a remote peer sends a compressed payload exceeding the 128 MiB decompression limit and a malformed DEFLATE byte is included, the system is unable to process the input correctly, resulting in a fatal unhandled error that leads to the termination of the Node.js process. This exploitation can be executed remotely and does not require authentication, posing a significant risk to organizations that leverage Undici for their Node.js applications. Maintaining operational continuity becomes challenging due to the potential for repeated crashes upon reconnection attempts.

Potential impact of CVE-2026-85024

1. Service Disruption: The vulnerability can cause complete service crashes in Node.js applications using the affected versions of Undici, leading to significant downtime and reduced availability for users.

2. Escalated Operational Costs: Frequent crashes due to this vulnerability necessitate increased technical support and resources to investigate and mitigate the issue, resulting in amplified operational costs for affected organizations.

3. Security Consequences: The ability for remote unauthenticated exploitation poses security risks, enabling potential attackers to disrupt services and exploit vulnerabilities within organizational infrastructures, which could lead to broader security breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

This is an advertDeploy the Patch →

References