CVE-2026-85024

Name of the Vulnerable Software and Affected Versions undici versions 6.25.0 through 6.28.0 undici versions 7.28.0 through 7.29.0 undici versions 8.1.0 through 8.10.1

Description A flaw in the WebSocket client's permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including the error listener, while the stream remains active. If a remote peer sends a compressed payload that exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, the inflate stream emits a data error. Because no listener is attached, Node.js treats this as a fatal unhandled error and terminates the process. This allows for a remote, unauthenticated Denial of Service (DoS) attack where a small amount of data (approximately 130 KB) can crash the process.

Recommendations Upgrade to version 6.28.1 Upgrade to version 7.29.1 Upgrade to version 8.10.2