Cloudanix VulnDB

CVE-2026-87029

Medium · 5.9

CVSS

5.9

EPSS

0.3%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a common Node.js networking component lets a malicious website send specially crafted data that can unexpectedly shut down applications using that component, interrupting service until fixed.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Undici's decompress interceptor passes decompressed response data from zlib callbacks to downstream handlers without exception handling, allowing asynchronous throws (such as from the dump interceptor on oversized decompressed bodies) to become uncaught exceptions that terminate the Node.js process.

Why it matters to the business

Attackers can remotely crash Node.js applications that use affected undici versions, causing service outages and requiring restarts until patches are applied; the issue affects Red Hat Node.js packages in common server and application environments.

How an attack unfolds

An attacker controls or compromises an HTTP server that returns a small compressed response body. When the client using the decompress interceptor processes it, zlib decompression produces data exceeding a handler limit, triggering an uncaught throw from an asynchronous callback and terminating the process.

How to fix it

Upgrade undici to 7.30.1 or 8.12.2 or later. For Red Hat packages apply nodejs24-main fixed in 24.21.0-1.5.hum1 or nodejs26-main fixed in 11.20.0-1.26.11.1.0.4.hum1 via the referenced RHSA. As a temporary measure avoid composing decompress with handlers that throw on response data until upgraded.

How to confirm the fix worked

Confirm undici version is 7.30.1+, 8.12.2+ or the listed Red Hat package updates; test by sending a compressed response that exceeds the dump size limit and verify the process no longer crashes.

Typical attack path

  1. Attacker sets up or compromises an HTTP server to serve a malicious compressed response.
  2. Victim client configured with decompress + throwing handler (e.g., dump) sends request to the server.
  3. Server returns tiny compressed payload that expands beyond configured size on decompression.
  4. Zlib callback throws asynchronously; exception bypasses undici safeguards and crashes the Node.js process.

How to detect it

Review application and system logs for uncaught exceptions originating from zlib or undici response handling around the time of external HTTP requests; look for abrupt Node.js process terminations without other error context.

What your security team should do

  • Apply the Red Hat package updates for nodejs24-main and nodejs26-main immediately.
  • Audit applications for use of undici decompress interceptor combined with size-limiting handlers and upgrade dependencies.
  • Monitor for process crashes correlated with HTTP responses after applying fixes.

The record

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities