A critical vulnerability in the Undici WebSocket client allows an unauthenticated remote attacker to crash the Node.js process via a malicious compression parameter.

The vulnerability arises from insufficient validation of the server_max_window_bits parameter within the permessage-deflate extension. An unauthenticated attacker acting as a malicious server can trigger a synchronous RangeError exception, crashing the application process.

Successful exploitation of this flaw results in a complete denial of service for applications utilizing the affected Undici client. Given the CVSS score of 7.5, this high-severity risk could lead to significant operational downtime, disruption of critical services, and potential loss of data availability for any system relying on this WebSocket implementation.

Immediate Action: Update the Undici package to version 6.24.0 or 7.24.0 immediately to implement proper input validation and exception handling.

Proactive Monitoring: Monitor application logs for unexpected process crashes or frequent restarts, which may indicate attempted exploitation of this vulnerability.

Compensating Controls: While difficult to mitigate at the network level, ensure that applications are running in containerized environments with automated restart policies to minimize the impact of service interruptions.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a clear risk to service availability for any Node.js application using the Undici client. Given the ease of triggering this crash, organizations should prioritize updating to the patched versions as a standard maintenance activity. Failure to patch leaves applications exposed to simple, unauthenticated denial of service attacks.