{"id":"EUVD-2026-11704","revision":"242f3bd484df450db9e2ab91c8f4e529","records":[{"revision":"242f3bd484df450db9e2ab91c8f4e529","observedAt":"2026-11-05T04:58:20.345+00:00","statement":{"source":"euvd","id":"EUVD-2026-11704","aliases":["CVE-2026-2229","GHSA-v9p9-hfj2-hcw8"],"title":"ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00A0server_max_window_bits\u00A0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatic…","description":"ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00A0server_max_window_bits\u00A0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00A0server_max_window_bits\u00A0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n  *  The\u00A0isValidClientWindowBits()\u00A0function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n  *  The\u00A0createInflateRaw()\u00A0call is not wrapped in a try-catch block\n  *  The resulting exception propagates up through the call stack and crashes the Node.js process","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","https://hackerone.com/reports/3487486","https://cna.openjsf.org/security-advisories.html","https://datatracker.ietf.org/doc/html/rfc7692","https://nodejs.org/api/zlib.html#class-zlibinflateraw"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-11704","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 12, 2026, 8:27:05 PM","dateUpdated":"Sep 14, 2026, 12:04:29 PM"},"relatedAdvisories":[{"id":"RHSA-2026:34342","title":"Red Hat Security Advisory: Cluster Observability Operator 1.5.0","vulnerabilityIds":["CVE-2020-7753","CVE-2021-33623","CVE-2024-4068","CVE-2024-45338","CVE-2024-52011","CVE-2025-22868","CVE-2025-22870","CVE-2025-22872","CVE-2025-47911","CVE-2025-58190","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-4800","CVE-2026-4867","CVE-2026-6321","CVE-2026-6322","CVE-2026-6734","CVE-2026-9277","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-25680","CVE-2026-25681","CVE-2026-29063","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33814","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-33937","CVE-2026-33938","CVE-2026-33939","CVE-2026-33940","CVE-2026-33941","CVE-2026-39821","CVE-2026-42506","CVE-2026-48779"]},{"id":"RHSA-2026:7670","title":"Red Hat Security Advisory: nodejs:24 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-1528","CVE-2026-2229","CVE-2026-2581","CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717","CVE-2026-26996","CVE-2026-27135"]},{"id":"RHSA-2026:7302","title":"Red Hat Security Advisory: nodejs:22 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-21710","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135","CVE-2026-27904"]},{"id":"RHSA-2026:7983","title":"Red Hat Security Advisory: nodejs:22 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-21710","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135","CVE-2026-27904"]},{"id":"RHSA-2026:21772","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.28.0 Release.","vulnerabilityIds":["CVE-2025-14813","CVE-2025-68121","CVE-2026-0636","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-1605","CVE-2026-2229","CVE-2026-2327","CVE-2026-5588","CVE-2026-26996","CVE-2026-27904","CVE-2026-29074","CVE-2026-30827","CVE-2026-31802","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-32305","CVE-2026-33252","CVE-2026-33810","CVE-2026-34742","CVE-2026-35051","CVE-2026-39858","CVE-2026-40477","CVE-2026-40478","CVE-2026-40611","CVE-2026-40895","CVE-2026-40912","CVE-2026-40972","CVE-2026-40973","CVE-2026-40975","CVE-2026-41240","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:17789","title":"Red Hat Security Advisory: Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update","vulnerabilityIds":["CVE-2026-1002","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-4800","CVE-2026-4926","CVE-2026-33186","CVE-2026-33813","CVE-2026-33815","CVE-2026-33816","CVE-2026-33870","CVE-2026-33871","CVE-2026-34986","CVE-2026-39852","CVE-2026-40895"]},{"id":"RHSA-2026:5807","title":"Red Hat Security Advisory: RHOAI 2.16.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-25621","CVE-2025-6193","CVE-2025-12060","CVE-2025-12638","CVE-2025-12816","CVE-2025-61726","CVE-2025-61729","CVE-2025-66031","CVE-2025-66418","CVE-2025-66626","CVE-2025-68156","CVE-2025-69873","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-25223","CVE-2026-25639","CVE-2026-29074","CVE-2026-32141"]},{"id":"RHSA-2026:7123","title":"Red Hat Security Advisory: nodejs:22 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-21710","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135","CVE-2026-27904"]},{"id":"RHSA-2026:7350","title":"Red Hat Security Advisory: nodejs:24 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-1528","CVE-2026-2229","CVE-2026-2581","CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135"]},{"id":"RHSA-2026:7675","title":"Red Hat Security Advisory: nodejs24 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-1528","CVE-2026-2229","CVE-2026-2581","CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135"]},{"id":"RHSA-2026:56431","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2025-61726","CVE-2025-61729","CVE-2025-64718","CVE-2025-68470","CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-2229","CVE-2026-6321","CVE-2026-6322","CVE-2026-6733","CVE-2026-6734","CVE-2026-9358","CVE-2026-9679","CVE-2026-9697","CVE-2026-11525","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-22036","CVE-2026-25645","CVE-2026-33186","CVE-2026-33349","CVE-2026-33671","CVE-2026-33672","CVE-2026-33750","CVE-2026-34043","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-40181","CVE-2026-41305","CVE-2026-41650","CVE-2026-41907","CVE-2026-42342","CVE-2026-45409","CVE-2026-45736","CVE-2026-48779","CVE-2026-48801","CVE-2026-53550","CVE-2026-59869"]},{"id":"RHSA-2026:13826","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.4 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175","CVE-2026-40895"]},{"id":"RHSA-2026:9742","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2025-69873","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-25679","CVE-2026-26996","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-33036","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175"]},{"id":"RHSA-2026:7080","title":"Red Hat Security Advisory: nodejs22 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-21710","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135","CVE-2026-27904"]},{"id":"RHSA-2026:21931","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.5","vulnerabilityIds":["CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-29063","CVE-2026-33186","CVE-2026-33211","CVE-2026-34986"]},{"id":"RHSA-2026:7310","title":"Red Hat Security Advisory: nodejs22 security update","vulnerabilityIds":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-21710","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135","CVE-2026-27904"]},{"id":"RHSA-2026:73987","title":"Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61726","CVE-2025-66471","CVE-2025-71408","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-5422","CVE-2026-6321","CVE-2026-6734","CVE-2026-9697","CVE-2026-11816","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-13149","CVE-2026-15154","CVE-2026-15378","CVE-2026-16221","CVE-2026-16745","CVE-2026-18951","CVE-2026-23490","CVE-2026-25681","CVE-2026-27136","CVE-2026-27489","CVE-2026-27893","CVE-2026-28356","CVE-2026-28500","CVE-2026-28684","CVE-2026-31230","CVE-2026-31958","CVE-2026-32274","CVE-2026-32286","CVE-2026-32597","CVE-2026-33186","CVE-2026-33231","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-33815","CVE-2026-33816","CVE-2026-34445","CVE-2026-34986","CVE-2026-34993","CVE-2026-35397","CVE-2026-35536","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-40110","CVE-2026-41242","CVE-2026-42215","CVE-2026-42294","CVE-2026-42296","CVE-2026-42297","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-44240","CVE-2026-44431","CVE-2026-44432","CVE-2026-44727","CVE-2026-44843","CVE-2026-45736","CVE-2026-46595","CVE-2026-48526","CVE-2026-48586","CVE-2026-48710","CVE-2026-48746","CVE-2026-48779","CVE-2026-49855","CVE-2026-53550","CVE-2026-54058","CVE-2026-54283","CVE-2026-55969","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-62384","CVE-2026-63310","CVE-2026-64834","CVE-2026-64835","CVE-2026-66036","CVE-2026-66037","CVE-2026-66038","CVE-2026-66040","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-68770","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73627","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-84375","CVE-2026-84445"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-11704","identifiers":["EUVD-2026-11704","CVE-2026-2229","GHSA-v9p9-hfj2-hcw8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}