CVE-2026-2229: Undici WebSocket Client Denial-of-Service Vulnerability Due to Invalid server_max_window_bits Validation
Summary
CVE-2026-2229: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation. Affects undici across 2 version ranges.
< 6.24.0
>= 7.0.0, < 7.24.0
Fixed in 6.24.0 or 7.24.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is a popular HTTP/1.1 client designed for Node.js, known for its performance and efficiency in handling HTTP requests. It supports various features, including HTTP/2 and WebSocket connections. However, a vulnerability has been identified in its WebSocket client related to the permessage-deflate extension, which can lead to denial-of-service attacks if exploited by a malicious server.
Vulnerability Detail
The vulnerability arises from improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it advertises support for compression. If a malicious server responds with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15), the client attempts to create a zlib InflateRaw instance with this invalid value. This results in a synchronous RangeError exception that is not caught, leading to the termination of the Node.js process. The root causes include inadequate validation in the isValidClientWindowBits() function and the absence of a try-catch block around the createInflateRaw() call.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.24.06.24.0npm install undici@6.24.0 -
>= 7.0.0, < 7.24.07.24.0npm install undici@7.24.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched versions as soon as possible.
Conclusion
The Undici WebSocket client vulnerability CVE-2026-2229 poses a significant risk due to improper validation of the server_max_window_bits parameter, which can lead to denial-of-service attacks. Users are strongly advised to upgrade to the patched versions to mitigate this risk.
See every vulnerability recorded for undici →
FAQ
CVE-2026-2229 is a vulnerability in the Undici WebSocket client that can lead to denial-of-service attacks due to improper validation of the server_max_window_bits parameter.
If your application uses the Undici WebSocket client, a malicious server could exploit this vulnerability to crash your Node.js process, leading to downtime.
Versions of Undici prior to 6.24.0 and 7.24.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for undici.
