CVE-2026-9697

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. When a downstream handler throws asynchronously from a zlib callback, it escapes as an uncaught exception that terminates the Node.js process. A malicious HTTP server can send a small compressed body that decompresses to more than the configured limit, crashing the client.

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

The undici library (versions 5.15.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its WebSocket client that allows a malicious server to exhaust process memory by sending PING frames without reading PONG responses, causing unbounded growth of the outbound write queue and heap.

The undici library (versions 6.5.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its EventSource client that allows a malicious server to exhaust process memory by sending millions of tiny completed data fields without a blank event separator, or a single unfinished line split across many chunks, causing unbounded parser state accumulation beyond byte limits.

undici, an HTTP client library for Node.js, in versions 6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1 crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects the response due to a content-encoding limit, but the internal response stream was created before that check without an error listener or request abort, so the early close surfaces an unhandled error and terminates the process.

The undici library (versions 7.15.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its fetch() implementation that verifies Subresource Integrity (SRI) metadata by matching the algorithm token against a lowercase-only set, so a valid but non-lowercase token (e.g., uppercase SHA256) is treated as unknown and skipped, causing the response to be accepted without integrity check.

undici in versions 7.0.0-7.30.0 and 8.0.0-8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, builds the cache key from the original request URL before the redirect handler changes the origin. A response produced after a cross-origin redirect is stored under the original key, allowing persistent cache poisoning and disclosure of private data to a later unauthenticated caller.

undici in versions 4.0.0-6.29.0, 7.0.0-7.30.0, and 8.0.0-8.12.1 passes Agent constructor options through a JSON-based deep clone before forwarding them to each per-origin pool. Because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped, so a TLS peer whose certificate the custom callback was written to reject but which passes Node's default checks is silently accepted.

In undici (an HTTP client library for Node.js) versions 8.11.0 and 8.11.1, its experimental WebSocket client, enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits.

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.