CVE-2026-84890
published 2026-09-04CVE-2026-84890: undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.41%
34.4th percentile
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| grafana | grafana | — | — |
| nodejs | undici | >= 7.15.0 < 7.29.1 | 7.29.1 |
| nodejs | undici | >= 8.0.0 < 8.10.2 | 8.10.2 |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift4 | ose-monitoring-plugin-rhel9 | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-lightspeed-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
ghsa·2026-09-29
CVE-2026-84890 [MEDIUM] CWE-770 undici vulnerable to Denial of Service via unbounded decompression of compressed responses
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
### Impact
The `interceptors.decompress()` interceptor decompresses HTTP response bodies according to the untrusted `Content-Encoding` header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty upstream can return a small compressed payload (a compression bomb) that expands to hundreds of megabytes or gigabytes in client memory, exhausting memory and causing the Node.js process to crash or become unresponsive. Any application using the decompress interceptor to read responses from untrusted or compromised upstreams is affected.
### Patches
Upgrade to `7.29.1` or `8.10.2`. The intercepto
VulDB
Undici up to 7.29.0/8.10.1 Decompress Interceptor resource consumption
vuldb·2026-09-04·CVSS 5.9
CVE-2026-84890 [MEDIUM] Undici up to 7.29.0/8.10.1 Decompress Interceptor resource consumption
A vulnerability described as problematic has been identified in Undici up to 7.29.0/8.10.1. This affects an unknown function of the component Decompress Interceptor. Such manipulation leads to resource consumption.
This vulnerability is referenced as CVE-2026-84890. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
Red Hat
undici: undici: Denial of Service via unbounded decompression of compressed responses
vendor_redhat·2026-09-04·CVSS 5.9
CVE-2026-84890 [MEDIUM] CWE-409 undici: undici: Denial of Service via unbounded decompression of compressed responses
undici: undici: Denial of Service via unbounded decompression of compressed responses
A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a 'compression bomb,' which expands significantly in client memory. This unbounded decompression can lead to memory exhaustion and cause the application to crash, resulting in a Denial of Service (DoS).
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: openshift-pipelines/pipelines-console-plugin-pf5-rhel9 (OpenShift Pipelines) - Fix deferred
Package: openshift-pipelines/pipelines-console-pl
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84890 nodejs20: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-84890 [MEDIUM] CVE-2026-84890 nodejs20: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
CVE-2026-84890 nodejs20: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consu
Bugzilla
CVE-2026-84890 nodejs22: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-84890 [MEDIUM] CVE-2026-84890 nodejs22: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
CVE-2026-84890 nodejs22: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consu
Bugzilla
CVE-2026-84890 nodejs24: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-84890 [MEDIUM] CVE-2026-84890 nodejs24: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
CVE-2026-84890 nodejs24: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consu
Bugzilla
CVE-2026-84890 fbthrift: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-84890 [MEDIUM] CVE-2026-84890 fbthrift: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
CVE-2026-84890 fbthrift: undici: Denial of Service via unbounded decompression of compressed responses [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consu
Bugzilla
CVE-2026-84890 undici: undici: Denial of Service via unbounded decompression of compressed responses
bugzilla·2026-09-04·CVSS 5.9
CVE-2026-84890 [MEDIUM] CVE-2026-84890 undici: undici: Denial of Service via unbounded decompression of compressed responses
CVE-2026-84890 undici: undici: Denial of Service via unbounded decompression of compressed responses
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
2026-09-04
Published