undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

Vulnerability

Overview

The undici WebSocket client is vulnerable to a denial-of-service (DoS) attack through improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a client connects to a WebSocket server, it advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside the valid zlib range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination [1][2].

Root

Cause and Exploitation

The vulnerability exists because the isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the validly falls within the 8-15 range. Additionally, the createInflateRaw() call is not wrapped in a try-catch block, so the resulting exception propagates up the call stack and crashes the Node.js process. An attacker can exploit this by controlling a WebSocket server that the undici client connects to, sending a crafted extension negotiation response with an invalid server_max_window_bits value [1.

Impact

Successful exploitation leads to immediate termination of the Node.js process, resulting in a denial of service unavailability. The attack requires no authentication and can be performed by any malicious WebSocket server that the client connects to. This is a classic uncaught exception DoS vulnerability in a widely used HTTP/1.1 client library for Node.js [3].

Mitigation

As of the publication date (2026-03-12), no patch has been announced. Users should monitor the undici repository and the OpenJS Foundation security advisories for updates [4]. Until a fix is available, avoid connecting to untrusted WebSocket servers or consider implementing a workaround that validates the server_max_window_bits parameter before passing it to zlib.