{"id":"GHSA-v9p9-hfj2-hcw8","summary":"Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation","details":"### Impact\n\nThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range `server_max_window_bits` value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n1. The `isValidClientWindowBits()` function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n2. The `createInflateRaw()` call is not wrapped in a try-catch block\n3. The resulting exception propagates up through the call stack and crashes the Node.js process\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_","aliases":["CVE-2026-2229"],"modified":"2026-07-17T21:11:03.417982034Z","published":"2026-03-13T20:41:41Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-03-13T20:41:41Z","nvd_published_at":"2026-03-12T21:16:25Z","cwe_ids":["CWE-248"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229"},{"type":"WEB","url":"https://hackerone.com/reports/3487486"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc7692"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw"}],"affected":[{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.24.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v9p9-hfj2-hcw8/GHSA-v9p9-hfj2-hcw8.json"}},{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.24.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v9p9-hfj2-hcw8/GHSA-v9p9-hfj2-hcw8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}