CVE-2026-2229: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2229 is a denial-of-service vulnerability in the undici WebSocket client caused by an unhandled exception triggered by an invalid server_max_window_bits parameter in the permessage-deflate extension. It was disclosed on March 12, 2026, and affects undici versions below 6.24.0 and versions 7.0.0 through 7.24.0 (exclusive). The vulnerability has a CVSS v3.1 base score of 7.5 (High) per the GitHub Advisory Database, though the original undici security advisory scores it 5.9 (Moderate) with higher attack complexity (Github Advisory, Red Hat CVE). Downstream products from IBM (API Connect, Cloud Pak for Integration, QRadar Suite, App Connect Enterprise, Instana, and others) are also affected due to their bundled use of undici (Red Hat Bugzilla).

The root cause is a combination of CWE-248 (Uncaught Exception) and CWE-1284 (Improper Validation of Specified Quantity in Input). Specifically, the isValidClientWindowBits() function in undici's WebSocket implementation only checks that the server_max_window_bits value consists of ASCII digits — it does not verify that the value falls within zlib's required range of 8–15. When a malicious WebSocket server responds with an out-of-range value (e.g., 1 or 99) and subsequently sends a compressed frame, the client calls createInflateRaw() with the invalid windowBits value, which throws a synchronous RangeError. Because this call is not wrapped in a try-catch block, the exception propagates uncaught up the call stack and terminates the Node.js process immediately (Github Advisory, undici Advisory). The attack vector is network-based and requires no authentication or user interaction — only that the vulnerable client connects to a server controlled by the attacker.

Successful exploitation results in immediate and complete termination of the Node.js process running the undici WebSocket client, causing a full denial of service for any application relying on that process. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any service or application using undici's WebSocket client to connect to external or untrusted WebSocket servers is at risk, including enterprise products such as IBM API Connect, Cloud Pak for Integration, and QRadar Suite (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability was originally reported via HackerOne (report #3487486). The EPSS score is approximately 0.066%–0.175%, placing it in a low-to-moderate exploitation probability range (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or impersonate a WebSocket server that the vulnerable client connects to, which limits opportunistic exploitation but makes it viable in targeted or man-in-the-middle scenarios.

1. Set up a malicious WebSocket server: Deploy a WebSocket server that the target application (using undici) will connect to — either by controlling a legitimate endpoint, performing DNS spoofing, or executing a man-in-the-middle attack on an unencrypted WebSocket connection.
2. Accept the client's WebSocket upgrade request: When the vulnerable undici client connects, it automatically advertises support for the permessage-deflate extension in its Sec-WebSocket-Extensions header.
3. Respond with an invalid server_max_window_bits value: In the server's WebSocket handshake response, include a permessage-deflate extension parameter with an out-of-range server_max_window_bits value (e.g., permessage-deflate; server_max_window_bits=1 or server_max_window_bits=99), which bypasses undici's digit-only validation.
4. Send a compressed WebSocket frame: After the handshake completes, send any compressed WebSocket frame to the client. The client will attempt to instantiate zlib.createInflateRaw({ windowBits: <invalid_value> }).
5. Trigger process crash: The RangeError thrown by zlib propagates uncaught through the undici call stack, immediately terminating the Node.js process and causing denial of service (undici Advisory, Github Advisory).

• Logs: Unexpected Node.js process crash logs containing RangeError: Invalid windowBits or similar zlib-related errors in application logs or system journals; abrupt process exit with no graceful shutdown message.
• Network: Outbound WebSocket connections (ws:// or wss://) to unexpected or newly observed server endpoints; WebSocket handshake responses containing permessage-deflate with server_max_window_bits values outside the range 8–15 in captured traffic.
• Process: Sudden, unexplained termination of Node.js processes that use undici for WebSocket connections; process monitoring alerts for abnormal exit codes (non-zero) from Node.js services.

The fix is available in undici versions 6.24.0 (for the 6.x branch) and 7.24.0 (for the 7.x branch); users should upgrade immediately (Github Advisory). No official workaround is provided by the undici maintainers for users who cannot upgrade. As a network-level mitigation, restrict undici WebSocket clients to connect only to trusted, known-good WebSocket servers, and use TLS (wss://) to reduce man-in-the-middle risk. Red Hat has issued multiple errata (RHSA-2026:7080, 7123, 7302, 7350, 7670, 7675, 7983, and others) addressing this issue across RHEL 8, 9, and 10 (Red Hat Bugzilla). IBM has also released patches for affected products including API Connect, Cloud Pak for Integration, QRadar Suite, and App Connect Enterprise.

The vulnerability was published by the OpenJS Foundation CNA and remediated by undici maintainer mcollina, with UlisesGascon as remediation reviewer (undici Advisory). Red Hat rated the issue as high severity and promptly issued errata for RHEL 8, 9, and 10 within weeks of disclosure. IBM issued multiple security bulletins covering a broad range of enterprise products that bundle undici. Community coverage was limited to standard CVE tracking sites and Linux distribution security advisories, with no notable controversy or widespread social media discussion observed.