undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-85024 · Microsoft / collected KEV context

EUVD-2026-71603

GHSA-3wwx-pv8p-q78v

cve-program · CVE-2026-85024

• https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-71603

• https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-85024

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v

osv · GHSA-3wwx-pv8p-q78v

• https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v
• https://nvd.nist.gov/vuln/detail/CVE-2026-85024
• https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c
• https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6
• https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v6.28.1
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2

• undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed… · Advisory content revised · 5 Nov 2026