CVE-2026-84890 Overview
CVE-2026-84890 affects undici, the HTTP/1.1 client used by Node.js and widely embedded in server-side JavaScript applications. The decompress interceptor decompresses response bodies based on the untrusted Content-Encoding header returned by an upstream server. While the number of encoding layers is capped, the total decompressed output size is unbounded and cannot be configured. A malicious or misbehaving upstream can return a small compressed payload — a compression bomb — that expands into hundreds of megabytes in client memory. The asymmetric resource consumption exhausts process memory and crashes the Node.js runtime.
Critical Impact
A single small HTTP response can crash any Node.js process that uses undici's decompress interceptor against an attacker-influenced upstream.
Affected Products
- nodejs/undici versions 7.15.0 through 7.29.0
- nodejs/undici versions 8.0.0 through 8.10.1
- Applications and frameworks that embed undici and enable the decompress interceptor
Discovery Timeline
- 2026-09-04 - CVE-2026-84890 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-84890
Vulnerability Analysis
The flaw is an uncontrolled resource consumption issue classified under [CWE-770]. The decompress interceptor in undici inspects the upstream Content-Encoding header and streams the response body through the matching decoder (gzip, deflate, or br). The interceptor limits how many encoding layers it will process but does not enforce a ceiling on the total number of decompressed bytes. There is also no public configuration option to set such a ceiling. As a result, a client receiving a small compressed payload can allocate arbitrarily large buffers in memory before the response is fully processed.
Root Cause
The interceptor trusts the size relationship between compressed input and decompressed output. Decoders such as gzip and br can achieve compression ratios exceeding 1000:1 against highly redundant inputs. Without a byte cap on the decompressed stream, the client will continue reading and buffering until the process runs out of heap. Node.js terminates with an out-of-memory error, taking down every request the process was serving.
Attack Vector
Exploitation requires that an attacker control or influence an HTTP response reaching the vulnerable client. Common scenarios include applications that fetch remote URLs supplied by users, server-side request proxies, webhook consumers, and outbound API calls to third-party services that later turn hostile. The attacker responds with a small payload — for example, a few kilobytes of highly compressible zeros encoded with gzip or br — and sets the Content-Encoding header accordingly. When the undici client decompresses the stream, memory usage climbs until the runtime crashes.
No authentication is required on the client side and no user interaction is needed. The attack complexity is elevated because the target application must be configured to use the decompress interceptor and must contact an attacker-influenced endpoint.
Detection Methods for CVE-2026-84890
Indicators of Compromise
- Repeated Node.js process crashes with JavaScript heap out of memory or FATAL ERROR: Reached heap limit messages.
- Outbound HTTP responses with very small Content-Length values but Content-Encoding: gzip, deflate, or br immediately preceding process termination.
- Sudden RSS (resident set size) growth on Node.js workers correlated with a single outbound request.
Detection Strategies
- Inventory Node.js applications and identify use of undici in the 7.15.0–7.29.0 and 8.0.0–8.10.1 ranges, including transitive dependencies pulled in by frameworks such as Next.js, Fastify plugins, and the global fetch in modern Node.js.
- Instrument outbound HTTP calls to log the ratio of Content-Length to decompressed body size and alert on ratios above a reasonable threshold (for example, 100:1).
- Add software composition analysis rules that flag builds containing vulnerable undici versions.
Monitoring Recommendations
- Track Node.js process restart counts, heap usage, and OOM kills at the container and orchestrator layer.
- Forward application and container logs into a centralized analytics platform such as Singularity Data Lake to correlate crashes with the specific outbound host that served the compressed payload.
- Baseline normal decompressed response sizes per upstream and alert on deviations.
How to Mitigate CVE-2026-84890
Immediate Actions Required
- Upgrade undici to version 7.29.1 or 8.10.2 across all Node.js services and rebuild container images.
- Audit dependency trees with npm ls undici or pnpm why undici to catch nested versions that top-level upgrades may miss.
- Restart long-running Node.js workers after the upgrade so the patched module is loaded.
Patch Information
The undici maintainers released fixed versions 7.29.1 and 8.10.2. See the GitHub Advisory GHSA-3xpg-4rpp-hhhm and the OpenJSF Security Advisories page for release notes and commit references.
Workarounds
- Disable the decompress interceptor in code paths that fetch untrusted URLs and handle decompression manually with an enforced byte limit.
- Route outbound HTTP through a proxy or gateway that strips Content-Encoding or enforces a maximum response size before the payload reaches the Node.js process.
- Set Node.js --max-old-space-size conservatively and run workers under a supervisor so a crashed process is restarted quickly, reducing but not eliminating the impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
