The vulnerability arises when a WebSocket server replies with an invalid server_max_window_bits value outside the zlib‑defined range (8–15). The undici client attempts to create a zlib InflateRaw instance with this out‑of‑range value, causing a synchronous RangeError that is not caught. The exception propagates and terminates the Node.js process, resulting in a denial‑of‑service condition for any application that relies on that client. This bug is a fault in input validation (CWE-1284) that leads to an unhandled exception (CWE-248).

The undici library, which is the HTTP client used by many Node.js applications, is affected. No specific version range is listed in the advisory, so any version of undici that has not been updated to validate the server_max_window_bits parameter correctly is vulnerable. Users of undici in Node.js projects should assume the risk applies until a patch is applied.

The CVSS score of 7.5 classifies the bug as high severity. The EPSS score of less than 1% indicates a low predicted exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is remote: an attacker who controls a WebSocket server can send the crafted extension during the handshake. This requires no special privilege on the client side, so the vulnerability can be exploited from anywhere the client connects to such a server. Given the straightforward exploitation path and the severity, the risk is elevated for exposed services that rely on undici.