Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 Moderate-severity security fix in undici (7.29.1, 8.10.2) just released! Patches CVE-2026-84890: undici vulnerable to Denial of Service via unbounded decompression of compressed responses https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm
Post summary
A security fix for CVE-2026-84890, a Denial‑of‑Service vulnerability in undici, has been released in versions 7.29.1 and 8.10.2.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodejs | undici | - | node.js | - |