CVE-2026-84890
Description
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
How to fix
- nodejs undici7.29.1, 8.10.2 or later
- undici7.29.1, 8.10.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs undici | 7.15.0 ≤ v < 7.29.1, 8.0.0 ≤ v < 8.10.2 | 7.29.1, 8.10.2 |
| undicinpm | 7.15.0 ≤ v < 7.29.1, 8.0.0 ≤ v < 8.10.2 | 7.29.1, 8.10.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.