CVE-2026-84890
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.25%
- CWE
- CWE-770
- Published
- 2026-09-04
- Last modified
- 2026-09-04
Affected products
- undici undici
- undici undici
- undici undici
- undici undici
Weakness type
Related vulnerabilities
- CVE-2026-88012 — Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
- CVE-2026-45763 — Suricata lua: sandbox allocation limit not enforced for new allocations
- CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
- CVE-2026-87011 — Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- CVE-2023-54394 — PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
- CVE-2026-53937 — MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
- CVE-2026-86075 — n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
- CVE-2026-57099 — ASP.NET Core Denial of Service Vulnerability