MediumGHSA-3xpg-4rpp-hhhmCVE-2026-8489029 Sep · 24 days ago
undici vulnerable to Denial of Service via unbounded decompression of compressed responses.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Impact The interceptors.decompress() interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty upstream can return a small compressed payload (a compression bomb) that expands to hundreds of megabytes or gigabytes in client memory, exhausting memory and causing the Node.js process to crash or become unresponsive. Any application using the decompress interceptor to read responses from untrusted
SourcesGitHub advisory database
Timeline
29 Sep24 daysfrom publication to Patchwire
- Published by GitHub advisory database29 Sep
- Seen by Patchwire23 Oct
- Fix released29 Sep
undici7.29.18.10.2
Versions of undici
8.x
safe 8.10.2
7.x
safe 7.29.1
AffectedSafe
Related alerts(8)
Same packagesExploitable only if · read by Claude, the source remains the reference
- Project uses undici 6.x before 6.29.1, 7.x before 7.30.1, or 8.x before 8.12.2.
- Application calls undici's fetch() against servers that may be attacker-controlled or malicious.
- The server responds with more than five content codings and closes the connection before sending the body.
- Affected
- undici >=6.23.0 <6.29.1 · undici >=7.18.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-xjj6-f33q-929c
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici's EventSource client.
- undici version is below 6.29.1, 7.30.1, or 8.12.2 in the respective major line.
- The application maintains an EventSource connection to an untrusted or potentially compromised Server-Sent Events peer that controls the response.
- Affected
- undici >=6.5.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-4qv8-2p9j-2685
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici at version 7.15.0 or later, below the patched releases 7.30.1 / 8.12.2.
- Application calls undici's fetch() with Subresource Integrity (integrity) metadata.
- The integrity metadata uses an uppercase or mixed-case algorithm token (e.g. SHA256- or Sha256-).
- An attacker can control the response body returned by the server.
- Affected
- undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 7.30.1 · 8.12.2
- ID
- GHSA-f72v-6w45-q472
Exploitable only if · read by Claude, the source remains the reference
- undici version is 7.x before 7.30.1 or 8.x before 8.12.2.
- An originless Agent dispatcher is used (not an origin-bound Client or Pool).
- Interceptors are composed as compose(redirect(), cache()) (not compose(cache(), redirect())).
- The cache interceptor uses a shared cache (type: 'shared') backed by a MemoryCacheStore or SqliteCacheStore.
- Requests can follow redirects whose targets can be attacker-controlled or user-specific (e.g. cross-origin or private/no-store redirects).
- Affected
- undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 7.30.1 · 8.12.2
- ID
- GHSA-4w7w-5xrc-9h26
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici at a version before 6.29.1, 7.30.1, or 8.12.2.
- Requests are made through undici's Agent (including as default dispatcher for request, fetch, setGlobalDispatcher) or EnvHttpProxyAgent on direct/NO_PROXY routes.
- The Agent is constructed with a function-valued tls option, such as a custom checkServerIdentity callback for certificate or public-key pinning.
- The TLS options are passed via the tls option rather than via connect.
- Affected
- undici >=4.0.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-2m5v-pch6-74hx
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici (directly or via Node.js global fetch()) at a version before 6.29.1, 7.30.1, or 8.12.2.
- The client makes HTTPS requests to an endpoint that is malicious or compromised.
- The connection to that endpoint negotiates TLS 1.2 (not restricted to TLS 1.3).
- The server initiates renegotiation after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host.
- Affected
- undici >=4.2.1 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-qrxm-fqhp-jwvm
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici's WebSocket client (directly or via Node.js's bundled globalThis.WebSocket).
- Installed undici version is 5.15.0 or later in the 5.x line, or a 6.x, 7.x, or 8.x release earlier than 6.29.1, 7.30.1, or 8.12.2 respectively.
- The client connects to a WebSocket server that is malicious or compromised and can stream PING frames without reading PONG responses.
- Affected
- undici >=5.15.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-9fm3-97px-rjf6
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici at a version before 7.30.1 (7.x) or before 8.12.2 (8.x).
- The client composes undici's decompress interceptor with a downstream response handler that throws during response processing (e.g. the dump interceptor with maxSize).
- The client makes requests to an HTTP server that may be malicious or compromised and can return a compressed body that decompresses beyond the configured limit.
- Affected
- undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 7.30.1 · 8.12.2
- ID
- GHSA-55wc-3pg8-jfw6