Read the docs
TI-2026-01876 Aliases CVE-2026-2229GHSA-v9p9-hfj2-hcw8

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

Priority MEDIUM 41CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 14 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination. The vulnerability exists because: * The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 * The createInflateRaw() call is not wrapped in a try-catch block * The resulting exception propagates up through the call stack and crashes the Node.js process

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01003 63rd percentileScored 2026-11-07
Fix Partial undici (undici): 6.24.0: 7.24.0undici (npm): 6.24.0, 7.24.0Red Hat: 17 advisoriesRed Hat: 14 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSundici< 6.24.0; 7.0.0 < 7.24.06.24.0: 7.24.0Patch availableCNA
—undici (npm)before 6.24.06.24.0Patch availableGHSA-v9p9-hfj2-hcw8
—undici (npm)7.0.0 to before 7.24.07.24.0Patch availableGHSA-v9p9-hfj2-hcw8
  • undici VendorNodeJS Affected < 6.24.0; 7.0.0 < 7.24.0 Fixed in 6.24.0: 7.24.0 Patch available CNA
  • undici (npm) Vendor— Affected before 6.24.0 Fixed in 6.24.0 Patch available GHSA-v9p9-hfj2-hcw8
  • undici (npm) Vendor— Affected 7.0.0 to before 7.24.0 Fixed in 7.24.0 Patch available GHSA-v9p9-hfj2-hcw8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*before 6.24.0; 7.0.0 to before 7.24.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions before 6.24.0; 7.0.0 to before 7.24.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA undici (undici) Fixed in 6.24.0: 7.24.0
  • Fix · GHSA-v9p9-hfj2-hcw8 undici (npm) Fixed in 6.24.0 Advisory →
  • Fix · GHSA-v9p9-hfj2-hcw8 undici (npm) Fixed in 7.24.0 Advisory →

Red Hat 17 advisories

  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:56431 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:34342 Released 2026-07-01 · Red Hat rating Critical
    Cluster Observability Operator 1.5.0
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
Show 14 more Red Hat advisories
  • RHSA-2026:21931 Released 2026-05-29 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.5
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9
  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:7983 Released 2026-04-14 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.s390x::nodejs:22 +28
  • RHSA-2026:7670 Released 2026-04-13 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.s390x::nodejs:24 +25
  • RHSA-2026:7675 Released 2026-04-13 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.14.1-2.el10_1, nodejs24-devel-1:24.14.1-2.el10_1, nodejs24-docs-1:24.14.1-2.el10_1 +3
  • RHSA-2026:7350 Released 2026-04-09 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.s390x::nodejs:24 +25
  • RHSA-2026:7310 Released 2026-04-09 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.22.2-2.el10_0, nodejs-devel-1:22.22.2-2.el10_0, nodejs-docs-1:22.22.2-2.el10_0 +4
  • RHSA-2026:7302 Released 2026-04-09 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22 +28
  • RHSA-2026:7123 Released 2026-04-08 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22 +28
  • RHSA-2026:7080 Released 2026-04-08 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.22.2-1.el10_1, nodejs-devel-1:22.22.2-1.el10_1, nodejs-docs-1:22.22.2-1.el10_1 +4
  • RHSA-2026:5807 Released 2026-03-25 · Red Hat rating Important
    RHOAI 2.16.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Self-service automation portal 2AffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:34342
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:7080, RHSA-2026:7675
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:7123, RHSA-2026:7670
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:7302, RHSA-2026:7350
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:7310
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:7983
Red Hat OpenShift AI 2.16Fixed RHSA-2026:5807
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Red Hat OpenShift Pipelines 1.20Fixed RHSA-2026:21931
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:56431
Not affected: 13 products
  • Cluster Observability Operator 1.5
  • Cryostat 4 on RHEL 9
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.16
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat OpenShift Pipelines 1.20
  • Red Hat Openshift Data Foundation 4.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2229
  2. 2026-10-03 Alias added: GHSA-v9p9-hfj2-hcw8
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-10 Fix available: Red Hat OpenShift Pipelines 1.20 · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat
  6. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Advisory 3

Other 4

  • TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
  • TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
  • TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
  • TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
  • TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
  • TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences