undici, a Node.js HTTP client library, forwards data from zlib’s decompress callbacks to downstream handlers without catching exceptions that those callbacks may throw. When a downstream handler—such as the built‑in dump interceptor—throws intentionally after decompression, the asynchronous exception propagates uncaught and terminates the Node.js process. The result is a denial of service that crashes any client that uses the decompress interceptor with a throwing handler, interrupting the availability of the affected application.

Vulnerable instances include undici versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1. Any deployment that composes the decompress interceptor with a response handler that throws on large bodies is at risk. This includes projects that rely on the built‑in dump interceptor or custom handlers that call throw on size limits.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available, so there is no publicly reported exploitation data yet. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the crash by sending a small compressed payload that decompresses to a size larger than the configured limit, making the likely attack vector remote HTTP requests from a malicious or compromised server.