undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

CVE-2026-85024 (tracking the same root cause as GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229) is an uncaught-exception crash in undici's WebSocket client. When a Node.js process connects as a WebSocket client to a server that advertises permessage-deflate with an out-of-range server_max_window_bits value (outside zlib's valid 8–15), undici passes it straight to zlib.createInflateRaw() without a try-catch. The synchronous RangeError propagates uncaught and terminates the process immediately. Affected: undici < 6.24.0 and 7.0.0–7.23.x. Fixed in 6.24.0 and 7.24.0. Because undici ships bundled in Node.js 20.x, 22.x, and 24.x, any app on those runtimes using the built-in WebSocket global or importing undici directly is in scope.

The vendor's MEDIUM / 5.9 rating with AC:H is honest and accurate. The crucial constraint is directionality: this is a *client-side* bug. The attacker cannot scan you, cannot send you a packet, cannot exploit you remotely — your application must initiate an outbound WebSocket connection to an endpoint the attacker controls. That alone compresses the reachable population to Node.js services that act as WebSocket consumers of untrusted or externally-controlled endpoints. Most undici usage is plain HTTP fetch; WebSocket client usage is a fraction of that. The impact ceiling is a process crash (availability), with no path to code execution, data exfiltration, or lateral movement. NVD lists a parallel score of 7.5 HIGH (with AC:L), but the GitHub advisory's 5.9 MEDIUM with AC:H better reflects the real-world prerequisite that the victim must voluntarily connect outbound to the attacker's server.

Why this verdict

• Attack directionality is the dominant constraint. Unlike a server-side RCE, the attacker cannot scan the internet for victims. The victim's code must already be configured to open a WebSocket connection to an endpoint the attacker controls or has compromised. This is a meaningful, load-bearing prerequisite that filters out the vast majority of the undici install base.
• WebSocket client usage is a fraction of undici's footprint. Most Node.js applications use undici (or Node's built-in fetch()) for HTTP requests, not WebSocket connections. The vulnerable code path is only reached when the WebSocket constructor is used with permessage-deflate enabled.
• Impact ceiling is availability-only. The bug produces a RangeError crash — no memory corruption, no attacker-controlled data written, no code execution. Kubernetes, PM2, or systemd restart policies limit sustained outage to seconds.
• Role multiplier: (a) *Low-value roles* (dev machines, test servers): crash is a minor annoyance, auto-restarted. (b) *Typical roles* (backend API services): most don't use WebSocket client at all; those that do typically connect to trusted internal services, not attacker-controlled endpoints. (c) *High-value roles* — CI/CD runners fetching from WebSocket feeds, real-time trading/monitoring services consuming external WS endpoints: a crash here causes brief service disruption but the blast radius is host-level DoS only, not domain/fleet/supply-chain compromise. No high-value role produces an outcome exceeding availability impact, so the floor rule does not elevate severity.

Why not higher?

Upgrading to HIGH would require either active exploitation, a path to code execution, or a blast radius beyond a single-process crash. None of these apply. The client-side directionality constraint means an attacker cannot mass-exploit this at scale — they must wait for victims to connect to them. The impact is strictly availability; there is no confidentiality or integrity impact.

Why not lower?

Downgrading to LOW would undervalue the zero-interaction aspect once the connection is established (no authentication, no user interaction required beyond the initial outbound connection) and the fact that undici is bundled in every Node.js 20+ runtime, creating a large latent attack surface. The process crash is immediate and deterministic, not probabilistic.

1. Pin or upgrade undici to ≥ 6.24.0 or ≥ 7.24.0 — The only complete fix. Update package.json / package-lock.json or upgrade Node.js to a release that bundles the patched undici. Since this is MEDIUM, target the noisgate remediation SLA of 365 days, but earlier is better if your next Node.js update cycle is sooner.
2. Add a global uncaughtException handler as a stopgap — Adding process.on('uncaughtException', (err) => { /* log and recover */ }) prevents immediate process termination from this specific crash. This is a tactical band-aid, not a real fix — it masks the root cause. Use only as a bridge until you can upgrade.
3. Audit outbound WebSocket connections to untrusted endpoints — Inventory which services use undici's WebSocket constructor to connect to external or user-controlled endpoints. Services that only use fetch() for HTTP are not affected. Prioritize patching the services that consume untrusted WebSocket feeds.
4. Ensure process manager auto-restart is configured — Kubernetes liveness probes, PM2 --restart-delay, or systemd Restart=always limit the blast radius of a crash to a brief interruption (typically < 5 seconds). This does not prevent the crash but bounds the impact.

Run this on each target host or in your CI pipeline to check the installed undici version. Requires node and npm (or npx) on $PATH. No elevated privileges needed. Example: bash check_undici.sh

#!/usr/bin/env bash
# check_undici.sh — Detect CVE-2026-85024 (undici WebSocket permessage-deflate DoS)
# Run on any host with Node.js installed. No root required.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

CVE="CVE-2026-85024"
FIXED_6x="6.24.0"
FIXED_7x="7.24.0"

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Try to get undici version from the Node.js bundled copy first
BUNDLED_VER=$(node -e "try { console.log(require('undici/package.json').version) } catch(e) { console.log('none') }" 2>/dev/null || echo "none")

# Also check local node_modules
LOCAL_VER="none"
if [ -f node_modules/undici/package.json ]; then
  LOCAL_VER=$(node -e "console.log(require('./node_modules/undici/package.json').version)" 2>/dev/null || echo "none")
fi

check_version() {
  local ver="$1"
  local src="$2"
  if [ "$ver" = "none" ]; then
    return 2
  fi

  MAJOR=$(echo "$ver" | cut -d. -f1)

  if [ "$MAJOR" -le 6 ]; then
    if version_gte "$ver" "$FIXED_6x"; then
      echo "PATCHED — $src undici $ver >= $FIXED_6x ($CVE)"
      return 0
    else
      echo "VULNERABLE — $src undici $ver < $FIXED_6x ($CVE)"
      return 1
    fi
  elif [ "$MAJOR" -eq 7 ]; then
    if version_gte "$ver" "$FIXED_7x"; then
      echo "PATCHED — $src undici $ver >= $FIXED_7x ($CVE)"
      return 0
    else
      echo "VULNERABLE — $src undici $ver < $FIXED_7x ($CVE)"
      return 1
    fi
  else
    # Major version 8+ is assumed patched
    echo "PATCHED — $src undici $ver (major version $MAJOR, post-fix) ($CVE)"
    return 0
  fi
}

RESULT=2  # default UNKNOWN

if [ "$BUNDLED_VER" != "none" ]; then
  check_version "$BUNDLED_VER" "bundled" && RESULT=0 || RESULT=$?
fi

if [ "$LOCAL_VER" != "none" ]; then
  check_version "$LOCAL_VER" "local" && LOCAL_RESULT=0 || LOCAL_RESULT=$?
  # If local is vulnerable, override to vulnerable even if bundled is OK
  if [ "$LOCAL_RESULT" -eq 1 ]; then
    RESULT=1
  fi
fi

if [ "$BUNDLED_VER" = "none" ] && [ "$LOCAL_VER" = "none" ]; then
  echo "UNKNOWN — undici not found (not bundled, not in node_modules) ($CVE)"
  exit 2
fi

exit $RESULT

Sources

1. GitHub Security Advisory GHSA-v9p9-hfj2-hcw8
2. GitLab Advisory Database — CVE-2026-2229
3. OSV — GHSA-v9p9-hfj2-hcw8
4. NVD — CVE-2026-2229
5. Tenable Plugin 309957 — undici Multiple Vulnerabilities
6. Red Hat Errata RHSA-2026:7302
7. GHSA-vrm6-8vpv-qv8q — Related undici permessage-deflate advisory