CVE-2026-84890 Nodejs CVE debrief

Who should care

Node.js developers and administrators who use undici in their applications should be aware of this vulnerability and take steps to mitigate it by upgrading to undici 7.29.1 or 8.10.2. They should review the configuration of undici in their applications, ensure that the decompressed output size is limited, and monitor for potential DoS attacks. Additionally, they should consider implementing compensating controls for exposed systems and tracking exceptions.

Why it matters

A vulnerability in undici's decompress interceptor allows for asymmetric resource consumption, potentially leading to a denial-of-service (DoS) attack. Node.js developers and administrators who use undici in their applications should be aware of this vulnerability and take steps to mitigate it by upgrading to undici 7.29.1 or 8.10.2.

• Potential denial-of-service (DoS) attacks
• Asymmetric resource consumption leading to memory exhaustion
• Crash of the process due to memory exhaustion

Technical summary

The vulnerability is caused by the decompress interceptor decompressing response bodies according to the untrusted Content-Encoding header, which can lead to an unbounded decompressed output size. This can be exploited by a malicious or faulty upstream to return a small compressed payload that expands to hundreds of megabytes or more in client memory, causing an asymmetric resource consumption that can exhaust memory and crash the process. The vulnerability affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2.

Defensive priority

Upgrade to undici 7.29.1 or 8.10.2 to mitigate the vulnerability.

Recommended defensive actions

• Upgrade to undici 7.29.1 or 8.10.2
• Review and limit the decompressed output size
• Monitor for potential DoS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the decompress interceptor decompressing response bodies according to the untrusted Content-Encoding header, which can lead to an unbounded decompressed output size. This can be exploited by a malicious or faulty upstream to return a small compressed payload that expands to hundreds of megabytes or more in client memory, causing an asymmetric resource consumption that can exhaust memory and crash the process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.