CLEANSTART-2026-TX86596 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

🗓️ 15 Oct 2026 00:38:01Reported by GoogleType

osv-cleanstart🔗 osv.dev👁 2 Views

WebSocket client in undici allows persistent zlib inflate stream emissions.

Reporter	Title	Published	Views	Family All 116
IBM Security Bulletins	Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in undici (CVE-2026-18149, CVE-2026-18540, CVE-2026-19534, CVE-2026-84890, CVE-2026-84933, CVE-2026-84947, CVE-2026-84961, CVE-2026-85008, CVE-2026-85014, CVE-2026-85024)	15 Oct 202620:17	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator in IBM Integration is vulnerable to multiple vulnerabilities in undici	14 Oct 202615:07	–	ibm
Tenable Nessus	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3107)	29 Sep 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3123)	29 Sep 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-85024	4 Sep 202600:00	–	nessus
Amazon	Important: nodejs24	29 Sep 202600:00	–	amazon
Amazon	Important: nodejs22	29 Sep 202600:00	–	amazon
Chainguard	CVE-2026-85024 vulnerabilities	29 Sep 202620:55	–	cgr
Circl	CVE-2026-85024	4 Sep 202616:24	–	circl
CVE	CVE-2026-85024	4 Sep 202616:20	–	cve

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TX86596.json
osv	www.osv.dev/vulnerability/CVE-2026-85024
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-85024

15 Oct 2026 01:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9

EPSS0.00412

undici WebSocket client zlib inflate stream permessage-deflate