CVE-2026-87029— undici 拒绝服务漏洞：解压缩拦截器未处理异常
一分钟漏洞结论
影响对象
undici undici
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
undici 是 Node.js 的 HTTP 客户端库。在版本 7.15.0 至 7.30.0 以及 8.0.0 至 8.12.1 中，其解压缩拦截器（decompress interceptor）会将已解压缩的响应数据从 zlib 流事件回调中直接传递给下游处理器，而未捕获这些回调可能抛出的异常。尽管 undici 的引擎会将下游处理器抛出的同步异常转换为每次请求的失败，但当异常由 zlib 回调异步抛出时，这种保护机制并不存在。因此，如果下游处理器故意抛出异常（例如内置的 dump 拦截器在响应超过其配置的最
可能的 ATT&CK 技术 1 AI
T1499 · Endpoint Denial of Service
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-87029 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
来源: CVE Program / CVE List V5
Vulnerability Description
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-87029 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-87029 的情报信息
请登录查看更多情报信息。
CVE-2026-87029 其他参考 (1)
同批安全公告 · undici · 2026-10-15 · 共 9 条
| CVE-2026-109855 | 7.5 HIGH | undici WebSocket 客户端拒绝服务漏洞 |
| CVE-2026-87018 | 7.5 HIGH | undici 拒绝服务漏洞（TLS 1.2 证书变更重协商） |
| CVE-2026-109869 | 7.5 HIGH | undici 拒绝服务漏洞 |
| CVE-2026-109383 | 7.4 HIGH | undici TLS证书验证绕过漏洞 |
| CVE-2026-109829 | 7.4 HIGH | undici 缓存投毒和跨用户披露漏洞 |
| CVE-2026-109932 | 5.9 MEDIUM | undici WebSocket 客户端拒绝服务漏洞 |
| CVE-2026-109841 | 5.9 MEDIUM | undici 子资源完整性绕过漏洞 |
| CVE-2026-109924 | 5.9 MEDIUM | undici EventSource解析器拒绝服务漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-87029
暂无评论