CVE-2026-109869

Undergoing Analysis Undergoing Analysis - In Progress

Denial of Service in undici HTTP Client Library

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: openjs

Description

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109869

EUVD

EUVD-2026-102240

Affected Vendors & Products

Vendor	Product	Version / Range
undici	undici	6.23.0
undici	undici	7.18.0
undici	undici	8.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

This is a Denial of Service (DoS) vulnerability in the undici HTTP client library for Node.js. When a malicious server sends a response with more than five content codings and closes the connection early, undici's fetch() function crashes the Node.js process. The library creates an internal response stream before validating the content-encoding limit, leaving the stream orphaned. When the connection closes prematurely, Node.js detects a content-length mismatch and terminates the process due to an unhandled error.

The vulnerability affects undici versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1. It is fixed in versions 6.29.1, 7.30.1, and 8.12.2.

Detection Guidance

Check if your system uses undici versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, or 8.0.0 through 8.12.1. Run 'npm list undici' or check package.json to verify the version. Monitor Node.js process crashes during fetch() operations, especially after receiving responses with unusual content-encoding headers.

Impact Analysis

A remote, unauthenticated attacker can exploit this vulnerability by sending a single malicious response, causing the Node.js process to crash. This results in a denial of service, disrupting the availability of applications using vulnerable versions of undici. Even if the application catches the fetch() rejection, the process may still terminate due to the unhandled error on the orphaned stream.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing Node.js processes, which could disrupt services handling sensitive data. For GDPR, this may lead to service unavailability affecting data processing operations. For HIPAA, it could interrupt systems managing protected health information, potentially violating availability requirements. However, the vulnerability does not directly expose or leak data.

Mitigation Strategies

Upgrade undici to version 6.29.1, 7.30.1, or 8.12.2 or later. Use 'npm update undici' or modify package.json to specify the patched version. No workarounds exist, so upgrading is the only mitigation.

Hi! I’m here to help you understand CVE-2026-109869. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70