Listen to this Post
undici’s WebSocket client, which is also bundled into Node.js as the global globalThis.WebSocket, contains a critical flaw in its `permessage-deflate` decompression handling. When a remote WebSocket peer sends a compressed message that exceeds the built-in 128 MiB decompressed-payload limit and subsequently contains a malformed DEFLATE block, the internal `zlib.InflateRaw` stream emits a Z_DATA_ERROR. Under normal circumstances, this error would be caught by an error listener attached to the stream. However, during the size-limit cleanup routine in lib/web/websocket/permessage-deflate.js, the code calls `removeAllListeners()` on the `InflateRaw` instance. This indiscriminate removal strips not only non-essential listeners but also the critical error listener that would otherwise handle the Z_DATA_ERROR. Because the stream is left running, it emits the error event with no listener attached. In Node.js, an unhandled `’error’` event on a stream is treated as a fatal exception, causing the entire Node.js process to terminate immediately. This means that a single malicious WebSocket connection can crash an application, bypassing any error or close handlers defined on the public WebSocket interface, as those handlers cannot observe the failure occurring on the internal `InflateRaw` object. The attack is remote, unauthenticated, and requires no application mistake. It is also asymmetric: approximately 130 KB of compressed data on the wire expands past the 128 MiB limit, making it efficient for an attacker. Furthermore, the crash can be repeated on reconnect, leading to a persistent denial-of-service condition. This vulnerability affects applications that use the undici WebSocket client via `new WebSocket(…)` or Node.js’s bundled globalThis.WebSocket, and that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. The flaw is classified as CWE-248 (Uncaught Exception) and has a CVSS v3.1 score of 5.9 (Medium), with a CVSS v4.0 score of 8.2. The vulnerability was published on September 4, 2026, and patched in undici versions 6.28.1, 7.29.1, and 8.10.2. No workaround is available; upgrading is the only remediation.
DailyCVE Form
Platform: Node.js
Version: 6.25.0-8.10.2
Vulnerability : Uncaught Exception
Severity: Medium
date: 2026-09-04
Prediction: 2026-09-04
What Undercode Say
Check the undici version in your project npm ls undici Check the undici version bundled with Node.js node -p "process.versions.undici"
// Example of a vulnerable WebSocket client connection
const ws = new WebSocket('ws://attacker-controlled-server.com');
// Application-level error handler that will NOT catch the internal InflateRaw error
ws.addEventListener('error', (event) => {
console.error('WebSocket error:', event);
});
How Exploit: (Educational Purposes!)
// Attacker-side WebSocket server (pseudo-code)
const WebSocket = require('ws');
const zlib = require('zlib');
const wss = new WebSocket.Server({ port: 8080 });
wss.on('connection', (ws) => {
// Craft a permessage-deflate compressed message that
// exceeds 128 MiB decompressed and contains a malformed DEFLATE block.
const largePayload = Buffer.alloc(128 1024 1024 + 1); // >128 MiB
const compressed = zlib.deflateRawSync(largePayload);
// Append a malformed DEFLATE byte to trigger Z_DATA_ERROR
const malformed = Buffer.concat([compressed, Buffer.from([0xff, 0xff, 0xff])]);
ws.send(malformed);
});
Protection: from this CVE
Upgrade undici to a patched version npm install [email protected] For older release trains: npm install [email protected] npm install [email protected]
// If using Node.js bundled globalThis.WebSocket, // ensure Node.js is updated to a version that ships a patched undici. // Check the bundled version: console.log(process.versions.undici);
Impact
undici’s WebSocket client crashes the entire Node.js process when a remote peer sends a permessage-deflate compressed message that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block. The size-limit cleanup removes all listeners from the internal zlib InflateRaw, leaving the stream running; the subsequent `Z_DATA_ERROR` has no listener and is treated as a fatal unhandled error, terminating the process. Application error/close handlers on the public WebSocket cannot observe or prevent this. A malicious or compromised WebSocket server can crash a client with a single connection, unauthenticated and without any application mistake. The attack is asymmetric (about 130 KB on the wire expands past the limit) and can be repeated on reconnect (crash loop). Affected applications are those using the undici WebSocket client (new WebSocket(...)) or Node.js’s bundled `globalThis.WebSocket` that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
