This vulnerability occurs when the WebSocket client uses the permessage-deflate extension and the internal zlib inflate stream removes its error listener during size‑limit cleanup. A malicious remote peer can then send a compressed frame that expands beyond the 128 MiB decompression threshold and includes a malformed DEFLATE byte. The inflate stream produces a data error but, because the error listener has been removed, Node.js treats the event as an unhandled exception and terminates the entire process, resulting in a denial of service. The flaw corresponds to CWE‑248 and CWE‑431, representing unhandled exceptions and improper handling of input sizes.

Affected products are the undici library for Node.js. The issue exists in versions 6.25.0 through 6.28.1, 7.28.0 through 7.29.1, and 8.1.0 through 8.10.2. Users should upgrade to the latest patched releases 6.28.1, 7.29.1, or 8.10.2 to eliminate the flaw.

The CVSS score of 5.9 indicates a moderate severity level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not known to be actively exploited. Nevertheless, the exploit is remote, unauthenticated, and requires no specific application configuration besides the WebSocket connection. An attacker can send a crafted payload of roughly 130 KB that decompresses past the built‑in limit, triggering a crash. Because the crash terminates the process, repeated attempts can be made, making the threat asymmetric. This kind of weakness is represented by CWE‑248 and CWE‑431. The overall risk remains moderate: significant impact with limited exploitation probability in the absence of a specific target.