CVE-2026-85024: 
Grafana Analyse et atténuation des vulnérabilités

CVE-2026-85024 is a Denial of Service vulnerability in the undici WebSocket client's permessage-deflate decompression extension, which can crash the entire Node.js process when a remote peer sends a specially crafted compressed WebSocket message. The flaw was disclosed on September 4, 2026, and affects undici versions 6.25.0–6.28.0, 7.28.0–7.29.0, and 8.1.0–8.10.1, including Node.js's bundled globalThis.WebSocket. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-248 (Uncaught Exception) and CWE-431 (Missing Handler). In lib/web/websocket/permessage-deflate.js, the size-limit cleanup routine calls removeAllListeners() on the internal zlib InflateRaw stream, inadvertently removing its error listener while the stream can still emit events. When a remote peer sends a compressed WebSocket payload that exceeds the built-in 128 MiB decompressed-payload limit followed by a malformed DEFLATE byte, the InflateRaw stream emits a Z_DATA_ERROR with no listener attached. Node.js treats this as a fatal unhandled error event and terminates the entire process; application-level WebSocket error handlers cannot intercept it because the failing object is the internal stream, not the public WebSocket (GitHub Advisory).

Successful exploitation results in an immediate, complete crash of the Node.js process hosting the vulnerable undici WebSocket client, causing a full availability outage with no confidentiality or integrity impact. The attack is highly asymmetric — approximately 130 KB of compressed data on the wire is sufficient to trigger the crash — and can be repeated on every reconnect attempt, enabling a sustained crash loop. Any application using new WebSocket(...) via undici or Node.js's bundled globalThis.WebSocket that can be induced to connect to an attacker-controlled or compromised WebSocket server is at risk (GitHub Advisory).

Exploitation is remote and unauthenticated, requiring no application misconfiguration and no user interaction, though it does require the victim client to connect to an attacker-controlled or compromised WebSocket server (contributing to the High attack complexity rating). No public proof-of-concept exploit has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Set up a malicious WebSocket server: Deploy a WebSocket server that supports the permessage-deflate extension and is capable of sending crafted compressed frames.
2. Induce the victim to connect: Lure or position the target Node.js application (using undici or Node.js's bundled globalThis.WebSocket) to connect to the attacker-controlled WebSocket endpoint — for example, via a man-in-the-middle attack on an unprotected WebSocket connection or by compromising a legitimate WebSocket server.
3. Craft the malicious payload: Construct a compressed WebSocket message that, when decompressed, exceeds the 128 MiB payload limit. The compressed form is approximately 130 KB on the wire (e.g., a highly compressible repeated-byte payload).
4. Append a malformed DEFLATE block: Append a malformed DEFLATE byte sequence after the oversized payload to trigger a Z_DATA_ERROR from the InflateRaw stream after the size-limit cleanup has removed all listeners.
5. Trigger process crash: Send the crafted frame to the connected client. The InflateRaw stream emits an unhandled error, Node.js terminates the process, and the application crashes. Reconnect attempts can be exploited repeatedly to maintain a crash loop (GitHub Advisory).

• Logs: Sudden, unexplained Node.js process termination with an unhandled Z_DATA_ERROR or Error: zlib: invalid block type in application or system logs; repeated process restarts in a short time window.
• Network: Inbound WebSocket connections from unexpected or external peers to client-side WebSocket endpoints; large compressed WebSocket frames (~130 KB) received from a WebSocket server, particularly if followed immediately by a process crash.
• Process: Unexpected termination of Node.js processes running undici-based applications; process manager (e.g., PM2, systemd) logs showing repeated restarts of the same service in rapid succession (GitHub Advisory).

Users should upgrade undici to the patched versions: 6.28.1, 7.29.1, or 8.10.2, depending on the currently installed version branch. No workaround is available — the fix requires upgrading, as there is no configuration option to prevent the vulnerable code path. Applications using Node.js's bundled globalThis.WebSocket should also ensure their Node.js version ships with a patched undici (GitHub Advisory).

The advisory was published by maintainer mcollina on the undici GitHub repository on September 4, 2026, with UlisesGascon credited as the reporter and krsecu as the remediation reviewer. UlisesGascon also posted about the disclosure on Bluesky shortly after publication. Red Hat tracked the issue via Bugzilla (bug #2528707) and published a corresponding CVE page. Community reaction has been limited given the moderate severity and lack of public exploit (GitHub Advisory, Red Hat).