CVE-2026-85024

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in the internal zlib inflate stream. This unhandled error leads to the termination of the entire Node.js process, making the service unavailable.

A denial of service flaw exists in the undici WebSocket client, which is used by Node.js. A remote, unauthenticated attacker can send a specially crafted compressed WebSocket message that, upon decompression, exceeds a size limit and contains a malformed DEFLATE block. This can lead to an unhandled error and terminate the Node.js process, causing a denial of service. The attack is asymmetric, allowing a small on-wire payload to crash the process, and can be repeated upon reconnection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.