HTTP Client Library Vulnerability in undici by Node.js

CVE-2026-87029

What is CVE-2026-87029?

The undici HTTP client library for Node.js contains a flaw related to improper exception handling in its decompress interceptor. This issue arises in versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, where decompressed response data can trigger uncaught exceptions if a downstream handler throws an error asynchronously. This situation can lead to an application crash, particularly if a malicious or compromised server sends a small compressed response that expands to exceed a configured maximum size. Mitigation steps include upgrading to undici versions 7.30.1 or later, and avoiding the use of throwing response handlers in conjunction with the decompress interceptor until an upgrade is performed.

References