5.9

CVE-2026-84890

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nodejs ≫ Undici SwPlatform node.js Version >= 7.15.0 < 7.29.1
Nodejs ≫ Undici SwPlatform node.js Version >= 8.0.0 < 8.10.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.163
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
ce714d77-add3-4f53-aff5-83d477b104bb 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://cna.openjsf.org/security-advisories.html
Vendor Advisory
https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm
Vendor Advisory
Mitigation