Node undici: In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler… (CVE-2026-87029)

The undici HTTP client library for Node.js versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1 has a flaw in its decompress interceptor. The interceptor forwards decompressed response data from zlib stream event callbacks without handling exceptions that may be thrown asynchronously by downstream handlers. While synchronous throws from downstream handlers are converted into per-request failures, asynchronous throws from zlib callbacks are not caught, resulting in uncaught exceptions that crash the Node.js process. This can be triggered by a malicious or compromised HTTP server sending a compressed response that decompresses to a size exceeding the configured limit, causing the built-in dump interceptor to throw and crash the client. The vulnerability is addressed in undici versions 7.30.1 and 8.12.2 and later.

Exploitation of this vulnerability allows a malicious or compromised HTTP server to cause a denial of service by crashing the Node.js process running the undici client. This occurs when the server sends a compressed response that decompresses to a size exceeding the configured maximum, triggering an uncaught asynchronous exception. There is no impact on confidentiality or integrity, only availability is affected.

A fix is available in undici versions 7.30.1 and 8.12.2 and later; users should upgrade to these versions or newer. As a temporary workaround before upgrading, avoid composing the decompress interceptor with response handlers that throw exceptions during response processing.