CVE-2026-85024 Overview
CVE-2026-85024 affects the WebSocket client bundled with undici, the HTTP/1.1 client used by Node.js. The permessage-deflate size-limit cleanup path removes all listeners from the internal zlib inflate stream, including the error listener, while that stream can still emit. A remote peer that sends a compressed WebSocket payload exceeding the 128 MiB decompressed-payload limit followed by a malformed DEFLATE byte causes the inflate stream to emit an unhandled error, terminating the Node.js process. The flaw is remote, unauthenticated, and highly asymmetric: roughly 130 KB on the wire is sufficient to crash a process, and attackers can reconnect to repeat the crash [CWE-248].
Critical Impact
Remote unauthenticated attackers can crash any Node.js process using an affected undici WebSocket client, enabling sustained denial of service with minimal bandwidth.
Affected Products
- undici versions 6.25.0 through 6.28.0
- undici versions 7.28.0 through 7.29.0
- undici versions 8.1.0 through 8.10.1
Discovery Timeline
- 2026-09-04 - CVE-2026-85024 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85024
Vulnerability Analysis
The vulnerability sits in the WebSocket permessage-deflate extension handling in undici. When a compressed frame decompresses beyond the built-in 128 MiB limit, undici invokes a cleanup routine that calls removeAllListeners() on the underlying zlib inflate stream. This cleanup indiscriminately strips the error event handler even though the stream remains alive and can still emit asynchronously.
If the compressed payload that triggered the size overflow also contains a malformed DEFLATE byte, zlib emits an error event immediately after cleanup. With no listener registered, Node.js promotes the error to an unhandled exception at the event-loop level and terminates the process. The bug is classified as an Uncaught Exception issue.
Root Cause
The root cause is unsafe listener management combined with an assumption that the inflate stream is inert after size-limit enforcement. Removing all listeners without also destroying or muting the stream leaves a window where zlib can emit errors into a listener-less EventEmitter. Node.js treats unhandled error events as fatal by design, converting a recoverable protocol violation into a process crash.
Attack Vector
Exploitation requires only that the target application acts as a WebSocket client connecting to an attacker-controlled endpoint, or that an attacker can influence WebSocket upstream traffic. The attacker negotiates the permessage-deflate extension, sends a compressed frame that expands past 128 MiB, and appends a corrupted DEFLATE byte. The wire cost is roughly 130 KB per crash, and repeated reconnects produce a persistent denial of service. No authentication, user interaction, or application coding mistake is required. See the GitHub Security Advisory GHSA-3wwx-pv8p-q78v for maintainer details.
Detection Methods for CVE-2026-85024
Indicators of Compromise
- Sudden Node.js process termination with an unhandled Error originating from zlib inflate operations in stack traces or crash logs.
- Process supervisor logs (systemd, PM2, Kubernetes) showing repeated restarts of the same Node.js service correlated with outbound WebSocket connections.
- WebSocket sessions that negotiated permessage-deflate and received frames whose decompressed size approaches or exceeds 128 MiB from a small compressed payload.
Detection Strategies
- Inventory Node.js applications and dependency trees for undici versions in the vulnerable ranges using npm ls undici or software composition analysis (SCA) tooling.
- Correlate application crash telemetry with concurrent outbound WebSocket traffic to untrusted endpoints.
- Inspect network telemetry for WebSocket handshakes advertising Sec-WebSocket-Extensions: permessage-deflate followed by unusually high compression ratios.
Monitoring Recommendations
- Enable process crash reporting and forward uncaughtException traces to centralized logging for pattern analysis.
- Alert on abnormal restart rates for services that maintain outbound WebSocket connections.
- Track dependency drift so newly introduced transitive uses of vulnerable undici versions surface in CI/CD scans.
How to Mitigate CVE-2026-85024
Immediate Actions Required
- Upgrade undici to version 6.28.1, 7.29.1, or 8.10.2 depending on the major version in use.
- Audit direct and transitive dependencies, including recent Node.js releases that bundle undici, and pin fixed versions.
- Restrict outbound WebSocket connections from server-side applications to trusted, known endpoints where feasible.
Patch Information
The maintainers fixed the issue in undici6.28.1, 7.29.1, and 8.10.2. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-3wwx-pv8p-q78v for release notes and commit references.
Workarounds
- Disable the permessage-deflate extension on WebSocket clients when the application controls extension negotiation.
- Front outbound WebSocket traffic with a proxy that strips or rejects permessage-deflate for untrusted peers.
- Run affected services under a supervisor with rapid restart and rate-limiting on reconnect attempts to blunt sustained crash loops until patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
