THREAT OPS › Threat News › [NVD] CVE-2026-2229 (HIGH 7.5) — ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-d
[NVD] CVE-2026-2229 (HIGH 7.5) — ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-d
CVE-2026-2229 CVSS: 7.5 HIGH Published: 2026-03-12T21:16:25.573
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with
MITRE ATT&CK techniques
- CompressionT1027.015
Indicators of compromise
- CVE-2026-2229cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-2229