Node undici: undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. (CVE-2026-84890)

The undici HTTP client library's decompress interceptor processes HTTP response bodies according to the Content-Encoding header. When used with untrusted upstreams, it does not limit the total decompressed size, enabling an attacker to send a small compressed payload that decompresses into a very large memory allocation. This can cause the Node.js process to crash or hang, resulting in a denial of service. The issue affects undici versions >=7.15.0 <7.29.1 and >=8.0.0 <8.10.2 and is addressed in versions 7.29.1 and 8.10.2 by implementing a maxSize limit on decompressed output.

An attacker controlling an upstream server or a man-in-the-middle can exploit this vulnerability by sending a compressed HTTP response with a malicious Content-Encoding header that triggers unbounded decompression. This leads to excessive memory consumption, causing the Node.js process to crash or become unresponsive, resulting in denial of service. There is no impact on confidentiality or integrity, only availability.

Upgrade undici to version 7.29.1 or later, or 8.10.2 or later, where a maximum decompressed size limit has been implemented to prevent unbounded decompression. Until upgraded, avoid using the decompress interceptor with untrusted upstreams or implement external controls to limit response sizes. Patch status is confirmed fixed in these versions.