Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress interceptor, which caps the decompression chain at 5 layers but does n...

CVE-2026-84890

A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a 'compression bomb,' which expands...

CVE-2026-84890

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

DEBIAN-CVE-2026-84890

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

UBUNTU-CVE-2026-84890

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890: Allocation of Resources Without Limits or Throttling

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890: Allocation of Resources Without Limits or Throttling

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

PT-2026-86206

Name of the Vulnerable Software and Affected Versions undici versions 7.15.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The decompress interceptor decompresses response bodies based on the untrusted Content-Encoding header. Although the number of encoding layers is capped, th...

Arbitrary Symlink Creation

decompress is vulnerable to arbitrary symlink creation. The vulnerability is due to insufficient validation of symlink targets during archive extraction, which allows an attacker to craft a malicious archive containing symlink entries that point to sensitive files outside the extraction directory...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

PT-2026-86706

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo decompress bio validates each on-disk segment length seg len only against the workspace cbuf size, not against the compressed input size compressed len...

PT-2026-86717

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress lznt decompress lznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds rea...

UBUNTU-CVE-2026-74723

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...

PT-2026-78506

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/os crypto/shared/msgs.c decompresses up to OS MAXSTR...

ANT-2026-61Y3NTY3 · suricata · Use-after-free

use-after-free high CVE-2026-45752 GHSA-qmc9-vqq2-8mv3 Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-61Y3NTY3:...

CVE-2026-57233

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

PT-2026-73062

Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Pandora contains a denial-of-service issue in its handling of DAA Direct Access Archive files. During the extraction of an internal ISO image from a DAA archive, the system uses the...