{"schema":"threatline.record/2","record":{"id":"CVE-2026-84890","aliases":["GHSA-3xpg-4rpp-hhhm"],"summary":"undici vulnerable to Denial of Service via unbounded decompression of compressed responses","details":"### Impact\n\nThe `interceptors.decompress()` interceptor decompresses HTTP response bodies according to the untrusted `Content-Encoding` header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty upstream can return a small compressed payload (a compression bomb) that expands to hundreds of megabytes or gigabytes in client memory, exhausting memory and causing the Node.js process to crash or become unresponsive. Any application using the decompress interceptor to read responses from untrusted or compromised upstreams is affected.\n\n### Patches\n\nUpgrade to `7.29.1` or `8.10.2`. The interceptor now accepts a `maxSize` option (default 64 MiB) and rejects responses whose decompressed output exceeds it with a `ResponseExceededMaxSizeError`.\n\n### Workarounds\n\nOnce upgraded, set a conservative `maxSize` on the interceptor. Before upgrading, avoid using `interceptors.decompress()` with untrusted upstreams, or apply a custom interceptor that enforces a decompressed output size limit.","categories":["Libraries & packages"],"product":"undici","vendor":"undici","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:20:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici"},"range":">= 7.15.0, < 7.29.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:20:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici"},"range":">= 8.0.0, < 8.10.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","source_modified_at":"2026-09-04T18:33:28.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"undici","vendor":"undici","versions":[{"versionType":"semver","status":"affected","version":"7.15.0","lessThan":"7.29.1"},{"versionType":"semver","status":"unaffected","version":"7.29.1"},{"versionType":"semver","status":"affected","version":"8.0.0","lessThan":"8.10.2"},{"versionType":"semver","status":"unaffected","version":"8.10.2"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:30:41.143057118Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici","purl":"pkg:npm/undici"},"ranges":[{"events":[{"introduced":"7.15.0"},{"fixed":"7.29.1"}],"type":"SEMVER"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:30:41.143057118Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici","purl":"pkg:npm/undici"},"ranges":[{"events":[{"introduced":"8.0.0"},{"fixed":"8.10.2"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:20:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici"},"version":"7.29.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:20:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici"},"version":"8.10.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","source_modified_at":"2026-09-04T18:33:28.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"undici","ecosystem":null},"version":"7.29.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","source_modified_at":"2026-09-04T18:33:28.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"undici","ecosystem":null},"version":"8.10.2","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:30:41.143057118Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici","purl":"pkg:npm/undici"},"version":"7.29.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3xpg-4rpp-hhhm","source_modified_at":"2026-09-29T18:30:41.143057118Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"undici","purl":"pkg:npm/undici"},"version":"8.10.2"}],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00412,"percentile":0.34398,"score_date":"2026-10-23"},"published_at":"2026-09-04T17:04:28.261Z","modified_at":"2026-09-29T18:30:41.143057118Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-29T18:20:38Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-04T18:33:28.246Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-3xpg-4rpp-hhhm","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-29T18:30:41.143057118Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84890","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890","source":"GitHub Advisory Database"},{"url":"https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11","source":"GitHub Advisory Database"},{"url":"https://github.com/nodejs/undici/commit/7aac7f12f757844763c8b8f1ab6e305e80d55838","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/nodejs/undici/releases/tag/v7.29.1","source":"GitHub Advisory Database"},{"url":"https://github.com/nodejs/undici/releases/tag/v8.10.2","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-04T18:32:49.819558Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-29T18:30:41.143057118Z","content_hash":"4977f7f88a2e14bf0addfffefbd309a8f89378e22330cba8032222829abb95d1"}}