Uncaught Exception in undici - CVE-2026-85024
Published: September 6, 2026
Vulnerability identifier: #VU147172
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85024
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in the WebSocket permessage-deflate decompression handler when processing a compressed WebSocket message that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block. A remote attacker can send a specially crafted compressed WebSocket message to cause a denial of service.
The internal InflateRaw error listener is removed while the stream continues running, causing an unhandled Z_DATA_ERROR to terminate the Node.js process.
Affected software
undici
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
How to mitigate CVE-2026-85024
Install security update from vendor's website.
undici - addressed in versions 6.28.1, 7.29.1, 8.10.2
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.29, 16.2.0.4
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.29, 16.2.0.4