--- id: CVE-2026-2229 title: "ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\_server_max_window_bits\_parameter in the permessage-deflate extension" summary: "ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\_server_max_window_bits\_parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automa…" severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-248 - CWE-1284 vendor: nodejs product: undici affected: - undici < 6.24.0 - 'undici >= 7.0.0, < 7.24.0' patched: - undici 7.24.0 published: '2026-03-12' updated: '2026-07-02' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-2229' references: - url: 'https://cna.openjsf.org/security-advisories.html' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://datatracker.ietf.org/doc/html/rfc7692' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://hackerone.com/reports/3487486' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://nodejs.org/api/zlib.html#class-zlibinflateraw' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://access.redhat.com/errata/RHSA-2026:13826' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:17789' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21772' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21931' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34342' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:5807' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7080' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7123' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7302' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7310' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7350' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7670' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7675' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7983' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:9742' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-2229' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2447143' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2229.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-2229' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-2229' - url: 'https://access.redhat.com/errata/RHSA-2026:56431' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.00874 epssPercentile: 0.57447 ingestedAt: '2026-07-02T12:34:40.384Z' ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-03-13T13:06:30.575811Z' --- ## Overview ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination. The vulnerability exists because: * The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 * The createInflateRaw() call is not wrapped in a try-catch block * The resulting exception propagates up through the call stack and crashes the Node.js process ## Affected - `undici < 6.24.0` - `undici >= 7.0.0, < 7.24.0` ## Remediation Upgrade past the affected range: - `undici 7.24.0` ## Vendor advisories - **RHSA-2026:17789** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:17789) - **RHSA-2026:7310** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7310) - **RHSA-2026:7080** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7080) - **RHSA-2026:7675** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7675) - **RHSA-2026:7123** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7123) - **RHSA-2026:7670** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-04-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:7670) - **RHSA-2026:7983** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-04-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:7983) - **RHSA-2026:7302** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7302) - **RHSA-2026:7350** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7350) - **RHSA-2026:34342** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34342) - **RHSA-2026:9742** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-04-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:9742) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, OpenShift Pipelines, Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI), Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, OpenShift Lightspeed, OpenShift Pipelines, Red Hat OpenShift AI (RHOAI), … · updated 2026-09-12 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2229.json)