CVE-2026-84890— undici vulnerable to Denial of Service via unbounded decompression of compressed responses
Quick assessment
Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
undici 的解压拦截器会根据不可信的 响应头来解压响应体。虽然 层的数量存在上限，但解压后的总输出大小却不受限制，且没有配置选项来对其进行限制。因此，恶意或故障的上游服务可以返回一个很小的压缩负载（即“压缩炸弹”），该负载在客户端内存中会膨胀至数百兆字节甚至更大，从而造成不对称的资源消耗，可能导致内存耗尽并使进程崩溃。 此问题影响 undici 7.15.0 至 7.29.1 以及 8.0.0 至 8.10.2 版本。用户应升级到 undici 7.29.1 或 8.10.2。
Possible ATT&CK Techniques 1 AI
T1027 · Obfuscated Files or Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84890
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
Source: CVE Program / CVE List V5
Vulnerability Description
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84890
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84890
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84890 (1)
Same Patch Batch · undici · 2026-09-04 · 11 CVEs total
| CVE-2026-19534 | 7.5 HIGH | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
| CVE-2026-85152 | 7.4 HIGH | undici vulnerable to cross-origin cache poisoning via missing origin isolation in intercep |
| CVE-2026-84961 | 7.4 HIGH | undici vulnerable to TLS certificate validation bypass via dropped connect options in Bala |
| CVE-2026-84933 | 6.5 MEDIUM | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
| CVE-2026-85024 | 5.9 MEDIUM | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate |
| CVE-2026-85014 | 5.9 MEDIUM | undici vulnerable to Denial of Service via WebSocketStream unclean close |
| CVE-2026-18149 | 5.9 MEDIUM | undici vulnerable to Denial of Service via orphaned RetryHandler response body |
| CVE-2026-85008 | 3.7 LOW | undici vulnerable to caching and replay of unsafe HTTP method responses |
| CVE-2026-84947 | 3.7 LOW | undici vulnerable to response truncation via oversized chunked responses in the dump inter |
| CVE-2026-18540 | 3.7 LOW | undici vulnerable to downstream response splitting via retry interceptor |
IV. Related Vulnerabilities
Same product: undici
-
CVE-2026-18149
undici vulnerable to Denial of Service via orphaned RetryHan -
CVE-2026-18540
undici vulnerable to downstream response splitting via retry -
CVE-2026-19534
undici vulnerable to Denial of Service via unrequested WebSo -
CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Co -
CVE-2026-84947
undici vulnerable to response truncation via oversized chunk
Same vendor: undici
-
CVE-2026-18149
undici vulnerable to Denial of Service via orphaned RetryHan -
CVE-2026-18540
undici vulnerable to downstream response splitting via retry -
CVE-2026-19534
undici vulnerable to Denial of Service via unrequested WebSo -
CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Co -
CVE-2026-84947
undici vulnerable to response truncation via oversized chunk
Same weakness: CWE-770
-
CVE-2026-85703
ramon-victor freegpt-webui Jailbreak Mode backend.py getJail -
CVE-2026-85664
Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhausti -
CVE-2026-82728
Unbounded HTTP/1 status-line and chunk-extension buffering i -
CVE-2026-82309
Robots::Validate versions from 0.3.2 before 0.3.11 for Perl -
CVE-2026-85584
SiYuan before v3.8.2 Denial of Service via Auth Throttle
V. Comments for CVE-2026-84890
No comments yet