CVE-2026-85024 Nodejs CVE debrief

Who should care

Node.js developers and administrators using undici versions 6.25.0 to 6.28.1, 7.28.0 to 7.29.1, or 8.1.0 to 8.10.2 should assess their exposure and upgrade to a fixed version to prevent potential process crashes.

Why it matters

CVE-2026-85024 is a medium-severity vulnerability in undici that can cause Node.js process crashes due to improper handling of compressed WebSocket payloads. Developers and administrators should assess their exposure, especially if using affected versions, and upgrade to a fixed version to prevent potential DoS attacks.

• Remote, unauthenticated attackers can crash Node.js processes
• Potential for denial-of-service (DoS) attacks
• Need to upgrade to a fixed undici version to prevent crashes

Technical summary

The undici WebSocket client has a vulnerability where the permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, causing Node.js to treat it as a fatal unhandled error and terminate the entire process.

Defensive priority

Upgrade to undici version 6.28.1, 7.29.1, or 8.10.2 to prevent process crashes due to this vulnerability.

Recommended defensive actions

• Upgrade to undici version 6.28.1, 7.29.1, or 8.10.2
• Review and update affected installations
• Monitor Node.js applications using undici for potential crashes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and potential impact. Vendor advisories are also available for reference. The vulnerability has been reported in undici versions 6.25.0 to 6.28.1, 7.28.0 to 7.29.1, and 8.1.0 to 8.10.2. Evidence is limited to public sources and may not be comprehensive. Further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.