undici WebSocket permessage-deflate parsing DoS via malformed DEFLATE (CVE-2025-60204)

Key Information Summary of the Vulnerability Vulnerability Overview Vulnerability Name: A Denial of Service (DoS) in the undici WebSocket client due to an unhandled error during decompression. CVE ID: CVE-2025-60204 Severity: Medium (CVSS v3.1 Base Score: 5.9 / 10; Attack Vector: Network; High Complexity; No Privileges Required; No User Interaction) Weakness Type: CWE-248 (Uncaught Exception/Error) Trigger Condition: A remote WebSocket server sends a malformed compressed message that crosses the and contains a malformed . Scope of Impact Affected Package: (npm) Affected Versions: - - - Affected Component: The undici WebSocket client (including Node.js's built-in ) Impact: Upon receiving a malformed compressed message, the internal zlib removes the listener, detaches stream listeners, and then throws a . Node.js treats this as an unhandled event, causing the entire Node.js process to crash. Attack Characteristics: The attack is asymmetric (payload size approximately 130 KB), is repeatable, and can trigger the crash without requiring any application-level error handling. Affected Applications: Applications using the undici WebSocket client ( ) or Node.js's built-in may be lured into connecting to a WebSocket endpoint controlled or compromised by the attacker. Remediation Patch Versions: Upgrade undici to v6.28.1, v7.29.1, or v8.10.2 (i.e., the fixed versions for the three affected release lines). Temporary Workaround: No workaround is available. POC / Exploitation Code This page does not include a POC or exploitation code block; it only describes the trigger mechanism in text (a malformed message combined with a malformed DEFLATE block causes to throw , leading to process crash). References RFC 7682: Compression Extensions for WebSocket

Goal Reached Thanks to every supporter — we hit 100%!

undici WebSocket permessage-deflate parsing DoS via malformed DEFLATE (CVE-2025-60204)

More from this source