CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. When a downstream handler throws asynchronously from a zlib callback, it escapes as an uncaught exception that terminates the Node.js process. A malicious HTTP server can send a small compressed body that decompresses to more than the configured limit, crashing the client.

The undici library (versions 5.15.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its WebSocket client that allows a malicious server to exhaust process memory by sending PING frames without reading PONG responses, causing unbounded growth of the outbound write queue and heap.

The undici library (versions 6.5.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its EventSource client that allows a malicious server to exhaust process memory by sending millions of tiny completed data fields without a blank event separator, or a single unfinished line split across many chunks, causing unbounded parser state accumulation beyond byte limits.

undici, an HTTP client library for Node.js, in versions 6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1 crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects the response due to a content-encoding limit, but the internal response stream was created before that check without an error listener or request abort, so the early close surfaces an unhandled error and terminates the process.

The undici library (versions 7.15.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its fetch() implementation that verifies Subresource Integrity (SRI) metadata by matching the algorithm token against a lowercase-only set, so a valid but non-lowercase token (e.g., uppercase SHA256) is treated as unknown and skipped, causing the response to be accepted without integrity check.

undici in versions 7.0.0-7.30.0 and 8.0.0-8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, builds the cache key from the original request URL before the redirect handler changes the origin. A response produced after a cross-origin redirect is stored under the original key, allowing persistent cache poisoning and disclosure of private data to a later unauthenticated caller.

undici in versions 4.0.0-6.29.0, 7.0.0-7.30.0, and 8.0.0-8.12.1 passes Agent constructor options through a JSON-based deep clone before forwarding them to each per-origin pool. Because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped, so a TLS peer whose certificate the custom callback was written to reject but which passes Node's default checks is silently accepted.

In undici (an HTTP client library for Node.js) versions 8.11.0 and 8.11.1, its experimental WebSocket client, enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits.

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A null dereference causes an uncaught TypeError that terminates the process.