Sign in
Deutsch English Español Polski
High

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

  • Disclosed: 13.03.2026
  • Updated: 11.10.2026 10:22

Impact

The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  1. The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  2. The createInflateRaw() call is not wrapped in a try-catch block
  3. The resulting exception propagates up through the call stack and crashes the Node.js process

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package undici < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-248
Platform
npm
Package
undici
Disclosed
13.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-v9p9-hfj2-hcw8 - CC BY 4.0

Vulnerability history: undici

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive
Total entries
46
First → latest
06.2022 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 21
  • Low 12

Disclosures per year

Severity:
  1. undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
    High · 7.5 CVE-2026-19534 >= 6.7.0, < 6.28.1, >= 7.0.0, < 7.29.1, >= 8.0.0, < 8.10.2 6.28.1, 7.29.1, 8.10.2
  2. undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
    High · 7.4 CVE-2026-84961 >= 7.24.1, < 7.29.1, >= 8.0.0, < 8.10.2 7.29.1, 8.10.2
  3. undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
    High · 7.4 CVE-2026-85152 >= 8.10.0, < 8.10.2 8.10.2
  4. undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
    High · 7.4 CVE-2026-13697 >= 7.0.0, < 7.29.0, >= 8.0.0, < 8.9.0 7.29.0, 8.9.0
  5. undici WebSocket client vulnerable to denial of service via fragment count bypass
    High · 7.5 CVE-2026-12151 < 6.27.0, >= 7.0.0, < 7.28.0, >= 8.0.0, < 8.5.0 6.27.0, 7.28.0, 8.5.0
  6. undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
    High · 7.5 CVE-2026-6734 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.2.0 7.28.0, 8.2.0
  7. undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
    High · 7.4 CVE-2026-9697 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.5.0 7.28.0, 8.5.0
  8. undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
    High · 7.5 CVE-2026-9675 >= 8.0.0, < 8.5.0 8.5.0
  9. Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
    High · 7.5 CVE-2026-1526 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  10. Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation this entry
    High · 7.5 CVE-2026-2229 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  11. Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
    High · 7.5 CVE-2026-1528 >= 6.0.0, < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  12. Regular Expression Denial of Service in Headers
    High · 7.5 CVE-2023-24807 < 5.19.1 5.19.1
  13. ProxyAgent vulnerable to MITM
    High · 7.7 CVE-2022-32210 >= 4.8.2, < 5.5.1 5.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.