undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

影響: npm:undici >= 7.15.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2

undici's decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. undici's engine converts a synchronous throw from a downstream handler into a per-request failure, but that protection is not in place when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, for example the built-in dump interceptor which throws when a res…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 04:02, GitHub Advisory Database에서 "undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-87029.