Detections
Analytics
SCA: security update for undici (GHSA-3wwx-pv8p-q78v)
medium Tenable Cloud Security Plugin ID 448450
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from
the internal zlib inflate stream, including its error listener, while that stream can still emit. When a
remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and
then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached,
which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote
and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire
expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici
versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should
upgrade to undici 6.28.1, 7.29.1, or 8.10.2. (CVE-2026-85024)
Solution
Update the undici library and its related packages to version 6.28.1 or later.See Also
Plugin Details
Severity: Medium
ID: 448450
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 9/29/2026
Updated: 9/29/2026
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.66
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-85024
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/28/2026
Vulnerability Publication Date: 9/4/2026
Reference Information
CVE: CVE-2026-85024
cwe: CWE-248