Undici’s decompress interceptor blindly expands response bodies based on the untrusted Content‑Encoding header. While the number of content‑encoding layers is capped, the total decompressed size is unlimited, giving an attacker the ability to send a tiny compressed payload that expands to hundreds of megabytes or more, exhausting the client’s memory and causing the process to crash. This flaw is classified as a resource‑exhaustion vulnerability (CWE‑770) and a concurrency error (CWE‑409), and results in a denial of service that can disrupt application availability.

The vulnerability exists in undici versions 7.15.0 through 7.29.1 and 8.0.0 through 8.10.2. The affected product is the JavaScript HTTP client library undici, commonly used in Node.js applications.

With a CVSS score of 5.9, the flaw represents moderate severity. The exploit probability is not quantified (EPSS not available) and the vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation to date. However, any system that acts as an undici client and receives responses from an untrusted upstream can be targeted. A malicious sender can craft a response encoded with a compression bomb that, when decompressed by the client, consumes excessive memory, ultimately leading to process termination and service disruption. The attack vector requires network access to the client’s inbound traffic where undici processes responses.