The undici WebSocket client performs permessage-deflate decompression without monitoring the size of decompressed data. A single small compressed frame can inflate into an extremely large payload, exhausting process memory and causing the Node.js application to crash or become unresponsive. This is a classic buffer uncontrolled growth attack that leads to denial of service.

Any Node.js application that imports the undici package, particularly when using the permessage-deflate WebSocket extension, is affected. The CVE does not specify vulnerable versions, so all releases that include the vulnerable PerMessageDeflate.decompress() method are at risk.

The vulnerability scores a CVSS of 7.5 (High) and has an EPSS below 1 %, indicating that exploitation is unlikely but still possible. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw by hosting a malicious WebSocket server that sends a compression bomb; the client will allocate memory without bound, leading to a resource exhaustion attack. The impact is limited to the Node.js process that handles the connection, potentially affecting the availability of the entire application.