CVE-2026-85024

Executive Summary

CVE-2026-85024 is a remote, unauthenticated denial-of-service vulnerability in Undici, the official HTTP/1.1 and WebSocket client bundled with Node.js. The flaw resides in the permessage-deflate size-limit cleanup logic of the WebSocket client, which removes all listeners — including the error listener — from the internal zlib inflate stream while that stream may still emit. A malicious peer can send a compressed payload exceeding the 128 MiB decompressed-payload limit followed by a malformed DEFLATE byte, triggering an unhandled error event that Node.js treats as fatal and uses to terminate the entire process. Systems running affected Undici versions (6.25.0–6.28.1, 7.28.0–7.29.1, 8.1.0–8.10.2) that connect to attacker-controlled WebSocket endpoints are impacted; the asymmetry (≈130 KB on the wire causes a full process crash) makes this trivially weaponizable for denial-of-service campaigns.

Technical Analysis

Undici ships a WebSocket client that supports the permessage-deflate extension, negotiated via the Sec-WebSocket-Extensions header during the WebSocket handshake. To decode compressed frames, the client maintains an internal zlib inflate stream. The vulnerable logic concerns the size-limit cleanup routine: when a compressed payload's decompressed size approaches or exceeds the built-in 128 MiB decompressed-payload limit, the cleanup routine tears down listeners registered on the inflate stream. Critically, this cleanup removes all listeners — including the error listener — while the underlying stream is still capable of emitting events.

The attack works because of a specific ordering condition. After the size limit is crossed, the inflate stream remains live. If the attacker then supplies a malformed DEFLATE byte, the zlib layer attempts to emit a data/error event. Because the error listener has already been removed, Node.js's EventEmitter semantics treat the unhandled 'error' event as a fatal exception. In Node.js, an unhandled 'error' event on an EventEmitter throws; in this context it propagates as a fatal unhandled error and terminates the entire Node.js process — not merely the WebSocket connection or the request handler.

Key characteristics deriving directly from the advisory:

• Trigger prerequisite: a negotiated permessage-deflate extension and a peer willing to emit crafted compressed frames.
• Precondition order: (1) decompressed size must cross the 128 MiB limit, (2) then a malformed DEFLATE byte must be present in the stream.
• Root cause class: improper cleanup / missing error handling — CWE-248 (Uncaught Exception).
• Asymmetry: roughly 130 KB of on-the-wire compressed data expands past the 128 MiB limit, so the attacker's cost is minimal relative to the defender's availability loss.
• No application mistake required: the vulnerable code path is in the library itself, not the consuming application.

The WebSocket handshake is unauthenticated by default at the protocol level, meaning any peer capable of reaching a WebSocket endpoint that a vulnerable client connects to (or any client that connects to an attacker-controlled WebSocket server) can initiate the sequence.

Exploitation Scenarios

No public PoC has been confirmed as weaponized in the wild; the following attack chain is inferred from the vulnerability class and the advisory description. Note: no CVE-specific exploit code or Nuclei template is available, and the chain below stays at the vulnerability-class level.

1. Reconnaissance / target identification. Identify applications or services using an affected Undici version and establishing outbound WebSocket connections to endpoints the attacker controls or can influence. Because Undici is the WebSocket client (not a server), the attacker's position is typically the WebSocket server side — a malicious or compromised upstream, a third-party API, or a service an attacker has already taken over. Alternatively, the attacker targets any flow where a vulnerable client connects to an attacker-influenced WebSocket endpoint.

2. Triggering the flaw class. During the WebSocket handshake, the permessage-deflate extension must be negotiated so compressed frames are processed. Once negotiated, the attacker sends a compressed payload crafted to expand beyond the 128 MiB decompressed-size limit. This crosses the limit and invokes the vulnerable size-limit cleanup, which strips listeners — including the error listener — from the internal zlib inflate stream.

3. Payload / execution method. The attacker follows the oversized payload with a malformed DEFLATE byte. The zlib inflate stream, now without its error listener, emits an error. In Node.js, the unhandled 'error' event is fatal, terminating the entire process. Because the wire cost is roughly 130 KB, the attacker expends minimal bandwidth to achieve the crash; the connection may be re-established to repeat the crash, sustaining the denial of service.

4. Post-exploitation impact. The primary outcome is availability loss: the Node.js process terminates, taking down whatever service the process serves. If the process is a long-running server, a worker, or a critical gateway, this is a full DoS. The attacker can reconnect and replay the sequence to maintain the outage. No confidentiality or integrity impact is documented (CVSS: C:N / I:N / A:H).

Attackers would presumably wrap this in automated reconnect loops or embed crafted WebSocket server responses in supply-chain/third-party integrations to induce crashes at scale. Because the CVSS vector is AC:H, exploitation requires conditions (negotiating permessage-deflate, delivering the crafted byte sequence in the right order, and reaching a vulnerable client that connects to the malicious peer) but does not require privileges or user interaction.

Impact Assessment

Base score: 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Subscore interpretation:

• AV:N (Network): exploitable remotely; the WebSocket connection is the attack vector.
• AC:H (High): success depends on preconditions — permessage-deflate negotiation, correct payload ordering, and the 128 MiB threshold crossing.
• PR:N / UI:N: no authentication or user interaction needed.
• S:U (Unchanged): impact is confined to the vulnerable component.
• C:N / I:N: no confidentiality or integrity impact — this is purely availability.
• A:H (High): total loss of availability of the affected process.

Business impact. Services built on Node.js across affected Undici versions may be crash-looped by remote attackers. Because permessage-deflate is a standard extension and is enabled by default in many WebSocket deployments, the exposed population is broad: real-time dashboards, streaming gateways, message brokers, and any service that consumes WebSocket feeds from third parties. Each crash is a full process termination — not a connection reset — so the blast radius extends to everything the process serves, including other tenants or requests it was handling.

Blast radius. Affected versions: 6.25.0 up to 6.28.1, 7.28.0 up to 7.29.1, and 8.1.0 up to 8.10.2. EPSS is low (0.00255, ~17.3rd percentile), and it is not in CISA KEV, suggesting limited observed exploitation to date — but the low cost-to-impact ratio and public disclosure status make escalation plausible.

Detection Guidance

Sigma Rule

title: Node.js Undici WebSocket permessage-deflate Listener-Strip DoS (CVE-2026-85024)
id: 8f2c1a4e-3b7d-4e9a-9c2f-5d1e7a6b0c34
status: experimental
description: Detects Node.js process termination caused by unhandled error events on the zlib inflate stream following a WebSocket permessage-deflate size-limit cleanup in Undici (CVE-2026-85024).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85024
  - https://github.com/nodejs/undici/security/advisories
author: valtersit.com
date: 2026/07/13
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: application
  product: nodejs
detection:
  selection_error:
    - message|contains: "Unhandled 'error' event"
    - message|contains: "Cannot read"
    - message|contains: "zlib"
    - message|contains: "inflate"
  selection_ws:
    - message|contains: "permessage-deflate"
    - message|contains: "websocket"
  selection_exit:
    - message|contains: "uncaughtException"
    - message|contains: "ERR_UNHANDLED"
  condition: selection_error and (selection_ws or selection_exit)
falsepositives:
  - Legitimate applications with verbose WebSocket debug logging
  - Non-malicious zlib stream errors during normal shutdown
level: medium

YARA Rule

rule CVE_2026_85024_Undici_PermessageDeflate_ListenerStrip
{
    meta:
        description = "Detects indicators of CVE-2026-85024 pattern strings in Undici WebSocket permessage-deflate handling"
        author = "valtersit.com"
        date = "2026-07-13"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85024"
        severity = "medium"

    strings:
        $ws1 = "permessage-deflate" ascii nocase
        $ws2 = "Sec-WebSocket-Extensions" ascii nocase
        $z1 = "zlib" ascii nocase
        $z2 = "inflate" ascii nocase
        $l1 = "removeAllListeners" ascii
        $l2 = "removeListener" ascii
        $err = "Unhandled 'error' event" ascii

    condition:
        (uint16(0) == 0x4D5A or uint32(0) == 0x464C457F or filesize < 10MB) and
        (($ws1 and $ws2 and 2 of ($z1, $z2))) or
        ($l1 and $z1) or ($l2 and $z1 and $err)
}

Note: The removeAllListeners/removeListener strings reflect the described cleanup behavior (listener removal from the inflate stream), and permessage-deflate / Sec-WebSocket-Extensions are protocol-level tokens named in the advisory context. Detection is heuristic and should be tuned to the deployed Undici bundle.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-85024 Undici WebSocket permessage-deflate oversized compressed frame (potential DoS trigger)"; flow:established,to_server,from_client; content:"permessage-deflate"; nocase; content:"Sec-WebSocket-Extensions"; nocase; threshold: type both, track by_src, count 1, seconds 30; reference:cve,2026-85024; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85024; classtype:attempted-dos; sid:2026850240; rev:1;)

Note: True detection requires per-frame compressed-size telemetry; this IDS signature covers the negotiation context and repeated handshake attempts, which is the observable network-layer signal. Decompressed-size threshold crossing (128 MiB) cannot be seen at the packet layer without stream reassembly and DEFLATE decoding.

Elastic Detection

sequence by process.pid
  [process where event.action == "start" and process.name == "node"]
  [process where event.action == "end"
     and process.exit_code != 0
     and process.args : "*websocket*"
     and rule.name : "*Unhandled*error*"]

Note: EQL is used here to correlate a Node.js process start with a subsequent abnormal exit carrying an unhandled-error signature. Field names must be mapped to the deployed Elastic Common Schema; if the unhandled-error signal is only in stdout/stderr, ingest it via a log shipper and match on message.

Splunk SPL Query

index=nodejs OR index=application (source=*node* OR sourcetype=nodejs)
| search ("Unhandled 'error' event" OR "uncaughtException" OR "zlib" OR "inflate")
| stats count by host, process, message
| where count > 0
| sort - count

Broader variant to surface crash loops:

index=application sourcetype=nodejs ("permessage-deflate" OR "Unhandled 'error' event")
| bin _time span=1m
| stats count values(message) as messages by host, _time
| where count >= 3

Wazuh OSSEC Rule

<group name="nodejs,undici,cve-2026-85024,">
  <rule id="2026850" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">Unhandled 'error' event</field>
    <description>CVE-2026-85024: Node.js Undici unhandled error event (possible zlib inflate listener-strip crash)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="2026851" level="8">
    <decoded_as>json</decoded_as>
    <field name="message">permessage-deflate</field>
    <field name="message">inflate</field>
    <description>CVE-2026-85024: Undici permessage-deflate / zlib inflate activity (context for DoS trigger)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="2026852" level="12" frequency="3" timeframe="120">
    <if_matched_sid>2026850</if_matched_sid>
    <same_field>hostname</same_field>
    <description>CVE-2026-85024: Repeated Node.js crashes within 120s — suspected DoS crash loop</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 4/4 — CONFIRMED. Fix corroborated by three independent sources (NVD, OSV, RHSA). Vendor remediation is limited to upgrading (no vendor-supplied workaround value provided).

1. Immediate mitigations.

   • If upgrading is not immediately possible, disable the permessage-deflate extension on WebSocket client connections where feasible, since the vulnerable code path requires the extension to be negotiated. Removing compression negotiation closes the attack vector.
   • Isolate or restrict outbound WebSocket connectivity so that only trusted, allowlisted endpoints can be reached — reducing the attacker's ability to serve crafted frames.
   • Run Node.js processes under a supervisor that restarts on crash while alerting on abnormal terminations, and add crash-loop rate alerting (see Detection Guidance) to limit sustained outage windows.
   • Add explicit unhandledRejection/uncaughtException handling at the application boundary as a partial containment measure; note this does not fix the library defect and may mask the crash.

2. Patch / upgrade steps.

   • Upgrade Undici to a fixed version: 6.28.1, 7.29.1, or 8.10.2 (matching the currently deployed major line).
   • Where Undici is bundled with Node.js, upgrade Node.js itself or update the bundled dependency per the Node.js release that ships the fixed Undici. Do not assume a Node.js patch release contains the fix unless it ships the corrected Undici version.
   • Verify the resolved version post-upgrade (e.g., inspect the installed Undici package version) to confirm the fix is in place. Patch confidence is 4/4, so upgrade is the authoritative remediation.
   • Rebuild/restart dependent services and re-run functional tests for WebSocket connectivity after the upgrade.

3. Long-term hardening.

   • Track Undici security advisories and pin dependency versions with automated update tooling.
   • Enforce resource limits (memory ceilings, process supervision, request/frame size caps) at the platform layer so a single malformed input cannot terminate a shared process.
   • Add upstream allowlisting and egress filtering for WebSocket connections, and prefer authenticated, mutually verified WebSocket endpoints for third-party integrations.
   • Incorporate crash-loop detection into availability monitoring and run the supplied detection rules across the fleet.

References

• NVD — CVE-2026-85024: https://nvd.nist.gov/vuln/detail/CVE-2026-85024
• OSV — Undici package advisory: https://osv.dev/vulnerability/CVE-2026-85024
• Red Hat Security Advisory (RHSA) — Undici/Node.js component update
• Undici project security advisories: https://github.com/nodejs/undici/security/advisories
• MITRE CWE-248 (Uncaught Exception): https://cwe.mitre.org/data/definitions/248.html

Threat actor / in-the-wild evidence: None reported. CVE-2026-85024 is not in CISA KEV, EPSS is low (0.00255, ~17.3rd percentile), and no public PoC, exploit code, or Nuclei template is confirmed. Public, remote, unauthenticated DoS with an asymmetric ~130 KB-to-crash ratio could attract opportunists; treat the absence of observed exploitation as a state-of-the-art at publication, not a guarantee.