A critical vulnerability in the undici WebSocket client allows unauthenticated remote attackers to trigger a denial-of-service condition by exploiting improper memory management during decompression.

The flaw resides in the PerMessageDeflate.decompress() method, which fails to enforce size limits on decompressed data. An unauthenticated attacker acting as a malicious WebSocket server can send a compressed data amplification payload, commonly known as a decompression bomb, to exhaust host memory.

The exploitation of this vulnerability leads to a denial-of-service state, causing the Node.js process to crash or become entirely unresponsive. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability and system stability. Organizations relying on undici for WebSocket communication face potential outages that could disrupt critical business operations.

Immediate Action: Update the undici package to version 6.24.0 or 7.24.0 immediately to implement necessary memory consumption limits.

Proactive Monitoring: Monitor Node.js process memory utilization and application logs for frequent crashes or unexpected restarts that may indicate attempted exploitation.

Compensating Controls: If immediate patching is not feasible, restrict outgoing WebSocket connections to trusted servers only, as the attack requires the client to connect to a malicious WebSocket endpoint.

Public Exploit Available: Unknown.

Due to the high severity and potential for service disruption, administrators should prioritize updating the undici library across all affected environments. Implementing the recommended versions provides the necessary safeguards against memory amplification attacks. Failure to patch leaves applications vulnerable to simple, unauthenticated denial-of-service attempts that can be triggered by any malicious remote WebSocket server.