{"action":"Upgrade undici to 6.28.1 or later.","affected":[{"fixed":"6.28.1","introduced":"6.25.0"},{"fixed":"7.29.1","introduced":"7.28.0"},{"fixed":"8.10.2","introduced":"8.1.0"}],"component":"undici","cve_ids":["CVE-2026-85024"],"ecosystem":"npm","epss":0.00412,"exploited":false,"fixed_versions":["6.28.1","7.29.1","8.10.2"],"ghsa_id":"GHSA-3wwx-pv8p-q78v","id":"tcs_01M5KEYH8HXTGC0M0YSMBBPH8Y","modified_at":"2026-09-28T22:00:08.266327162Z","published_at":"2026-09-28T21:42:37Z","references":["https://osv.dev/vulnerability/GHSA-3wwx-pv8p-q78v","https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","https://nvd.nist.gov/vuln/detail/CVE-2026-85024","https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c","https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6","https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-3wwx-pv8p-q78v","url":"https://osv.dev/vulnerability/GHSA-3wwx-pv8p-q78v"}],"summary":"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression"}