{"vulnerability": "cve-2026-85024", "sightings": [{"uuid": "ba6997b3-eaf3-4866-9046-a0db3b906e25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85024", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mupetrfbmk2w", "content": "\ud83d\udea8 Moderate-severity security fix in undici (6.28.1, 7.29.1, 8.10.2) just released!\n\nPatches CVE-2026-85024: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-09-04T16:24:24.729794Z"}, {"uuid": "fb3ed477-ebb4-42e2-a78f-4a8e4076b6ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85024", "type": "seen", "source": "https://gist.github.com/alon710/ffd73e42aa4d7534770f3c09713af03e", "content": "# CVE-2026-85024: CVE-2026-85024: Denial of Service via Uncaught Exception in undici WebSocket Client\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85024\n\n## Summary\nA high-severity Denial of Service (DoS) vulnerability exists in the undici WebSocket client implementation when processing compressed frames. The vulnerability is caused by a race condition where event listeners, including error handlers, are stripped from the active zlib stream during cleanup before the stream is fully terminated, leading to an unhandled exception.\n\n## TL;DR\nA race condition in undici's permessage-deflate cleanup allows remote servers to crash Node.js applications by sending an over-limit payload followed by trailing malformed bytes, triggering an uncaught exception.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248 (Uncaught Exception)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00412\n- **Exploit Status**: Proof of Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- undici packages using WebSockets with permessage-deflate enabled\n- Node.js instances using undici as native HTTP/WebSocket client\n- **undici**: >= 6.25.0, < 6.28.1 (Fixed in: `6.28.1`)\n- **undici**: >= 7.28.0, < 7.29.1 (Fixed in: `7.29.1`)\n- **undici**: >= 8.1.0, < 8.10.2 (Fixed in: `8.10.2`)\n\n## Mitigation\n\n- Upgrade the undici package to fixed version branches (v6.28.1, v7.29.1, or v8.10.2).\n- Use package overrides or resolutions to force secure transitives.\n- Disable the permessage-deflate extension during client-side WebSocket negotiation.\n\n**Remediation Steps:**\n1. Identify vulnerable occurrences of undici using npm ls undici.\n2. Modify package.json to override transitive references or directly run npm update undici.\n3. If deploying via Node.js system dependencies, upgrade the Node.js runtime binary to the latest LTS patch release.\n4. Deploy code changes and verify dependency resolutions using automated dependency scanners.\n\n## References\n\n- [GitHub Security Advisory GHSA-3wwx-pv8p-q78v](https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v)\n- [OpenJSF Security Directory](https://cna.openjsf.org/security-advisories.html)\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2026-85024)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85024) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-28T23:30:32.000000Z"}, {"uuid": "8385380c-9bd4-4088-9058-6244f9e91093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85024", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwnrsn2zxo2l", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-85024 impacts undici in 4 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/698\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-09-29T12:01:27.050638Z"}]}