Search: CVE-2026-85024

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.9	EPSS 0.4%	CVE-2026-85024Node undici · undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including Medium5.9EPSS 0.4%2026-09-04GCVE DatabaseCVE-2026-85024 A vulnerability in the undici WebSocket client for Node.js causes the process to crash when processing a specially crafted permessage-deflate compressed message that exceeds the decompressed payload size limit and contains a malformed DEFLATE block. This triggers an unhandled error in the internal zlib InflateRaw stream, leading to process termination. The issue affects undici versions 6.25.0 through before 6.28.1, 7.28.0 through before 7.29.1, and 8.1.0 through before 8.10.2. No workaround is available, but patched versions have been released. EPSS 0.4%Vulnerability CWE-248 #ghsa-3wwx-pv8p-q78v #npm	GCVE Database	2026-09-04

Page 1 of 1