undici vulnerable to Denial of Service via unbounded decompression of compressed responses

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-84890 · Microsoft / collected KEV context

EUVD-2026-71634

GHSA-3xpg-4rpp-hhhm

cve-program · CVE-2026-84890

• https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-71634

• https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-84890

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm

osv · GHSA-3xpg-4rpp-hhhm

• https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm
• https://nvd.nist.gov/vuln/detail/CVE-2026-84890
• https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11
• https://github.com/nodejs/undici/commit/7aac7f12f757844763c8b8f1ab6e305e80d55838
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2

• undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configur… · Advisory content revised · 5 Nov 2026