Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-09-04 | 2 | Patch2 |
| 2026-09-28 | 1 | Disclosure1 |
Anyone who can get your app to open a WebSocket to their server can force a full Node exit. Upgrade undici to 8.10.2 (or 7.29.1 / 6.28.1). CVE-2026-85024 https://hol.org/blog/cve-2026-85024-undici-websocket-permessage-deflate-dos https://t.co/PZONGDksCl
Post summary
CVE‑2026‑85024 causes Node.js to crash when a WebSocket connection is opened; upgrading undici to 8.10.2 (or 7.29.1/6.28.1) fixes the issue.
🟠 (undici, Uncaught Exception, #CVE-2026-85024 Medium) -DC-Sep2026-2604 https://dailycve.com/undici-uncaught-exception-cve-2026-85024-medium-dc-sep2026-2604/
Post summary
The text announces CVE-2026-85024 affecting undici with an uncaught exception and medium severity, but provides no exploit, PoC, patch, or evidence of active exploitation.
🚨 Moderate-severity security fix in undici (6.28.1, 7.29.1, 8.10.2) just released! Patches CVE-2026-85024: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v
Post summary
This post announces a security fix for undici versions 6.28.1, 7.29.1, and 8.10.2 that patches CVE‑2026‑85024, a Denial‑of‑Service flaw involving WebSocket permessage‑deflate decompression.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodejs | undici | - | node.js | - |