CVE-2026-84890: 
Grafana vulnerability analysis and mitigation

CVE-2026-84890 is a Denial of Service vulnerability in undici's decompress interceptor caused by unbounded decompression of compressed HTTP responses (a "compression bomb" attack). The interceptor decompresses response bodies based on the untrusted Content-Encoding header; while the number of decompression layers is capped at 5, the total decompressed output size is unlimited, allowing a malicious upstream to return a small payload that expands to hundreds of megabytes or more in client memory. Affected versions are undici 7.15.0 through 7.29.0 and 8.0.0 through 8.10.1. It was published on September 4, 2026, with a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). The interceptors.decompress() interceptor in undici trusts the server-supplied Content-Encoding header and decompresses the response body without enforcing any maximum output size limit. An attacker controlling or compromising an upstream server can craft a compression bomb — a small, highly compressed payload — that, when decompressed by the client, expands to gigabytes of data, exhausting the Node.js process's heap memory and causing a crash or unresponsiveness. The attack requires no authentication and no user interaction, though it does require the attacker to control or influence the upstream server response (GitHub Advisory).

Successful exploitation results in a Denial of Service: the Node.js process consuming undici crashes or becomes unresponsive due to memory exhaustion. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any application using undici's interceptors.decompress() to fetch responses from untrusted or compromised upstream servers is at risk, including server-side Node.js applications acting as HTTP clients or proxies (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is rated as non-automatable (per NVD SSVC), as it requires the attacker to control or compromise an upstream server that the vulnerable undici client communicates with, making opportunistic mass exploitation unlikely (GitHub Advisory, Red Hat CVE).

1. Identify target: Locate a Node.js application using undici with the interceptors.decompress() interceptor enabled that makes HTTP requests to an attacker-controlled or compromised upstream server.
2. Prepare compression bomb: Craft a highly compressed payload (e.g., using gzip or deflate) that decompresses to hundreds of megabytes or gigabytes. Classic compression bombs use nested or recursive compression to achieve extreme expansion ratios.
3. Set malicious Content-Encoding header: Configure the attacker-controlled upstream server to respond with the compression bomb payload and set the Content-Encoding header (e.g., Content-Encoding: gzip) to trigger undici's decompress interceptor.
4. Trigger the request: Cause the vulnerable undici client to make an HTTP request to the malicious upstream — this may occur naturally if the attacker controls a third-party API or CDN the application depends on, or via a Server-Side Request Forgery (SSRF) condition.
5. Exhaust memory: The decompress interceptor decompresses the payload without size limits, expanding it in client memory until the Node.js process runs out of heap space and crashes or becomes unresponsive (GitHub Advisory).

• Process Behavior: Node.js process consuming abnormally high and rapidly growing heap memory; process crash or OOM (Out of Memory) kill events associated with the undici HTTP client.
• Logs: Application logs showing unexpected crashes or unhandled promise rejections from undici's decompress interceptor; Node.js --max-old-space-size limit errors or heap allocation failures.
• Network: Unusually large HTTP responses (high Content-Length or chunked transfer with no size bound) from upstream servers with Content-Encoding headers (gzip, deflate, br, etc.); small response sizes on the wire that trigger disproportionate memory growth on the client.
• System: OS-level OOM killer events in system logs (e.g., /var/log/syslog or dmesg) terminating the Node.js process; sudden service unavailability of applications relying on undici for outbound HTTP requests.

Upgrade undici to version 7.29.1 or 8.10.2, which introduce a maxSize option (defaulting to 64 MiB) on the decompress interceptor; responses whose decompressed output exceeds this limit are rejected with a ResponseExceededMaxSizeError. As a pre-patch workaround, avoid using interceptors.decompress() with untrusted upstream servers, or implement a custom interceptor that enforces a decompressed output size limit. Additionally, configure process-level memory limits and monitor memory consumption in applications using undici (GitHub Advisory, Red Hat CVE).

The advisory was published by maintainer mcollina on the nodejs/undici GitHub repository on September 4, 2026, with UlisesGascon credited as remediation reviewer. Red Hat tracked the issue via their CVE advisory system. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking aggregators (GitHub Advisory, Red Hat CVE).