CLEANSTART-2026-XS80997: undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
Security vulnerability affects the npm package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/npmto a version that resolves this vulnerability.Fixed in 12.0.1-r1
Event History
Frequently Asked Questions
Which deployments should be reviewed first?
Review applications that depend on undici and use its bundled WebSocket client, particularly where WebSocket permessage-deflate is negotiated or exercised. The supplied information does not identify affected versions or indicate whether this occurs in a default configuration.
What runtime behavior could indicate exposure?
The issue is associated with permessage-deflate size-limit cleanup removing listeners from an internal zlib inflate stream while the stream can still emit, including removal of its error listener. Review WebSocket connections using compression and any related inflate-stream errors or unexpected connection behavior.
Is a workaround available if updating is not immediately possible?
The supplied advisory information does not provide a workaround, mitigation, or configuration change.