SB2026090617 - Multiple vulnerabilities in undici

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090617

SB2026090617 - Multiple vulnerabilities in undici

Published: September 6, 2026

Security Bulletin ID SB2026090617
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 70% Low 30%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Uncaught Exception (CVE-ID: CVE-2026-85024)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in the WebSocket permessage-deflate decompression handler when processing a compressed WebSocket message that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block. A remote attacker can send a specially crafted compressed WebSocket message to cause a denial of service.

The internal InflateRaw error listener is removed while the stream continues running, causing an unhandled Z_DATA_ERROR to terminate the Node.js process.


2) Uncaught Exception (CVE-ID: CVE-2026-85014)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in the WebSocketStream socket-close handler when handling an abrupt WebSocket connection closure while a writer lock is held. A remote attacker can abruptly close a WebSocket connection to cause a denial of service.

Exploitation requires an application to use the WebSocketStream API and write through a writer.


3) Origin validation error (CVE-ID: CVE-2026-85152)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and poison cached responses across origins.

The vulnerability exists due to improper origin validation in the cache and deduplication key generation of interceptors.cache() and interceptors.deduplicate() when sharing interceptor state across more than one origin. A remote attacker can control a response from one origin that is returned for a matching request to a different trusted origin to disclose sensitive information and poison cached responses across origins.

An Agent is not affected because its dispatch options include the request origin.


4) Insufficient verification of data authenticity (CVE-ID: CVE-2026-85008)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.

The vulnerability exists due to insufficient verification of response authenticity in the undici cache interceptor when processing cacheable responses to unsafe HTTP methods. A remote attacker can return a heuristically cacheable response with an explicit Cache-Control max-age directive to an unsafe HTTP request to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.

The issue occurs with the default methods: [\'GET\'] configuration.


5) Improper Certificate Validation (CVE-ID: CVE-2026-84961)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass custom TLS certificate validation.

The vulnerability exists due to improper certificate validation in undici BalancedPool when forwarding function-valued connect or tls options to per-upstream pools. A remote attacker can present a TLS certificate that is rejected by a configured custom checkServerIdentity callback but accepted by Node.js default hostname and chain validation to bypass custom TLS certificate validation.

Only applications using BalancedPool with a function-valued connect or tls option, such as a custom checkServerIdentity callback or connector, are affected.


6) Input validation error (CVE-ID: CVE-2026-84947)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause response truncation.

The vulnerability exists due to improper input validation in the dump interceptor when processing oversized chunked responses without a Content-Length header. A remote attacker can send an oversized chunked response to cause response truncation.

Exploitation requires the application to use the dump interceptor with an untrusted or misbehaving upstream.


7) Use of cache containing sensitive information (CVE-ID: CVE-2026-84933)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose cookies belonging to other users and inject cookies into cached responses.

The vulnerability exists due to improper handling of sensitive cookies in undici\'s interceptors.cache() when handling cacheable responses containing Set-Cookie headers in shared-cache mode. A remote attacker can provide a cacheable response containing a Set-Cookie header to disclose cookies belonging to other users and inject cookies into cached responses.

Private-cache mode is not affected.


8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-84890)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the interceptors.decompress() interceptor when decompressing HTTP response bodies according to an untrusted Content-Encoding header. A remote attacker can return a compression bomb as a compressed HTTP response to cause a denial of service.

Exploitation requires an application to use the decompress interceptor to read responses from an untrusted or compromised upstream.


9) Uncaught Exception (CVE-ID: CVE-2026-19534)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in the undici WebSocket client opening handshake when processing a server response containing an unrequested Sec-WebSocket-Protocol header. A remote attacker can send a crafted WebSocket handshake response to cause a denial of service.

Exploitation requires an application to open a WebSocket connection to an attacker-controlled or compromised server, or to use a plaintext ws:// connection subject to a machine-in-the-middle.


10) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-18540)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause downstream response splitting or desynchronization.

The vulnerability exists due to inconsistent interpretation of HTTP response framing in the retry interceptor when resuming a partial response from an attacker-controlled upstream. A remote attacker can cause resumed response bytes to be appended to a partially delivered response body while its original status and headers are retained to cause downstream response splitting or desynchronization.

Exploitation requires interceptors.retry() to be enabled and a downstream forwarder that does not recalculate Content-Length.


Remediation

Install update from vendor's website.

References