CVE-2026-109869
Received Received - Intake

Denial of Service in undici HTTP Client Library

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: openjs

Description
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-109869
EUVD
EUVD-2026-102240

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
undici undici 6.23.0
undici undici 7.18.0
undici undici 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in the undici HTTP client library for Node.js. When a malicious server sends a response with more than five content codings and closes the connection early, undici's fetch() function crashes the Node.js process. The library creates an internal response stream before validating the content-encoding limit, leaving the stream orphaned. When the connection closes prematurely, Node.js detects a content-length mismatch and terminates the process due to an unhandled error.

The vulnerability affects undici versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1. It is fixed in versions 6.29.1, 7.30.1, and 8.12.2.

Detection Guidance

Check if your system uses undici versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, or 8.0.0 through 8.12.1. Run 'npm list undici' or check package.json to verify the version. Monitor Node.js process crashes during fetch() operations, especially after receiving responses with unusual content-encoding headers.

Impact Analysis

A remote, unauthenticated attacker can exploit this vulnerability by sending a single malicious response, causing the Node.js process to crash. This results in a denial of service, disrupting the availability of applications using vulnerable versions of undici. Even if the application catches the fetch() rejection, the process may still terminate due to the unhandled error on the orphaned stream.

Mitigation Strategies

Upgrade undici to version 6.29.1, 7.30.1, or 8.12.2 or later. Use 'npm update undici' or modify package.json to specify the patched version. No workarounds exist, so upgrading is the only mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109869. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart