{"id":"ghsa-ghsa-55wc-3pg8-jfw6","seq":1708764,"kind":"advisory","title":"undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor","url":"https://github.com/advisories/GHSA-55wc-3pg8-jfw6","permalink":"https://vulnpulse.app/items/ghsa-ghsa-55wc-3pg8-jfw6","summary":"影響: npm:undici >= 7.15.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2\nundici's decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. undici's engine converts a synchronous throw from a downstream handler into a per-request failure, but that protection is not in place when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, for example the built-in dump interceptor which throws when a res…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-87029"],"tags":["GHSA-55wc-3pg8-jfw6","undici","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T19:02:10.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}