GHSA-v9p9-hfj2-hcw8 CVE-2026-2229

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

High npm

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.91%; Chance of exploitation in the next 30 days. Higher than 59.97% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-248 Uncaught Exception
Fix: 6.24.0; Upgrade undici to this version or later

Description

Impact

The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
The createInflateRaw() call is not wrapped in a try-catch block
The resulting exception propagates up through the call stack and crashes the Node.js process

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Affected versions

npm

Package	Vulnerable	Fixed in
undici	`< 6.24.0`	`6.24.0`
undici	`>= 7.0.0, < 7.24.0`	`7.24.0`
undici	`< 6.24.0`	`6.24.0`
undici	`>= 7.0.0, < 7.24.0`	`7.24.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

undici npm → `6.24.0`

npm

npm install undici@6.24.0

yarn

yarn add undici@6.24.0

pnpm

pnpm add undici@6.24.0

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-248: Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisories

Packages

github.com/nodejs/undici

Timeline

Mar 12, 2026 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor	High	Also affects undici
GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation	High	Also affects undici
GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering	High	Also affects undici
GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	High	Also affects undici
GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	High	Also affects undici
GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens	High	Also affects undici
GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects	Critical	Also affects undici
GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent	Critical	Also affects undici

Credits: UlisesGascon, aisle-research, mcollina

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor