← Vulnerability feed

Vulnerability record · CVE-2026-84890 · published 4 September 2026

CVE-2026-84890: Nodejs undici allocation without limits vulnerability

Nodejs · Undici

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

5.9 CVSS 3.1 Medium EPSS 0.41% · top 67.1% CWE-770 · Allocation without limits
5.9CVSS 3.1 base score
0.41%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
11 Sep 2026Last modified by NVD

Description

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.openjsf.org/security-advisories.html Vendor Advisory
https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm MitigationVendor Advisory

Track CVE-2026-84890 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-1525Nodejs undici http request smuggling vulnerabilityUndici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-leng…EPSS 0.49%9.8CVE-2022-35949Nodejs undici server-side request forgery (ssrf) vulnerabilityundici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes…EPSS 1.8%9.1CVE-2026-84961Nodejs undici improper certificate validation vulnerabilityundici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Bec…EPSS 0.25%9.1CVE-2026-13697Nodejs undici information exposure vulnerabilityundici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a…EPSS 0.57%8.8CVE-2026-6734Nodejs undici origin validation error vulnerabilityImpact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches…EPSS 0.39%8.2CVE-2026-84933Nodejs undici information exposure vulnerabilityundici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that …EPSS 0.34%7.5CVE-2026-19534Nodejs undici unchecked return value vulnerabilityundici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client ne…EPSS 0.39%7.5CVE-2026-85014Nodejs undici vulnerabilityundici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close…EPSS 0.54%

Source: NIST National Vulnerability Database (record CVE-2026-84890), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.