CVE-2026-109924 in undici
Summary
by MITRE • 10/15/2026
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in undici, a widely used HTTP client library for Node.js applications, represents a significant resource exhaustion risk stemming from improper handling of Server-Sent Events data streams. This flaw affects multiple major version lines, specifically versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1. The core issue resides within the EventSource client implementation, which is designed to parse incoming data fields from a server using the Server-Sent Events protocol. Under normal operation, this component processes event streams efficiently; however, it fails to adequately bound the internal parser state when processing maliciously crafted inputs. This deficiency allows an attacker who controls or compromises the peer providing the SSE stream to trigger a denial of service condition by forcing the Node.js process to consume excessive amounts of memory until termination occurs.
The technical mechanism behind this vulnerability involves specific parsing behaviors that are not constrained by existing size limits. When an untrusted server sends millions of tiny, completed data fields without including the required blank event separator, or when it transmits a single unfinished line split across numerous small chunks, the parser accumulates state information for each field and chunk. The library's configured maximum event size limit, maxEventSize, and the overall response size limit, maxResponseSize, are intended to prevent such exhaustion scenarios. However, these limits operate on the raw or compressed byte count of the body rather than the internal memory structures maintained by the parser during incremental parsing. Consequently, even if the total data volume remains within acceptable bounds according to these configuration parameters, the cumulative per-field and per-chunk state retained in memory grows indefinitely. This discrepancy means that an attacker can exploit this gap to cause a gradual but inevitable increase in memory usage without triggering standard size-based safeguards.
Furthermore, the vulnerability is exacerbated by how undici handles compressed responses. The maxResponseSize limit is enforced on the compressed body before decompression takes place. An attacker can leverage this behavior by sending a small amount of highly compressible data that expands significantly upon decompression within the parser's internal state management logic. This compression expansion effect allows a relatively small network payload to result in a disproportionately large memory footprint, accelerating the resource exhaustion process. The operational impact is strictly limited to availability, as the vulnerability does not permit remote code execution or direct data exfiltration. However, for applications that maintain persistent EventSource connections with untrusted peers, such as public APIs or third-party integrations where input validation on the server side cannot be guaranteed, this flaw poses a critical risk of service disruption due to out-of-memory errors and subsequent process crashes.
To mitigate this vulnerability, organizations must upgrade undici to patched versions that address these parsing logic flaws. The issue has been resolved in version 6.29.1 for the legacy branch, version 7.30.1 for the intermediate release line, and version 8.12.2 for the current stable release. These updated versions implement stricter bounds on the retained parser state independent of byte-level size limits, ensuring that memory consumption remains proportional to actual data processing rather than accumulating unchecked during stream parsing. There are no viable workarounds or configuration changes that can fully mitigate this risk in affected versions; therefore, immediate patching is required for any application relying on undici's EventSource functionality with untrusted inputs. This incident highlights the importance of validating not just input size but also internal state management complexity when processing streaming protocols like Server-Sent Events.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as it allows an attacker to exhaust system resources through crafted network traffic. It is also relevant to the ATT&CK technique T1499, Endpoint Denial of Service, specifically under subcategories involving resource exhaustion via application layer protocols. Security teams should audit their Node.js dependencies for undici versions within the affected ranges and prioritize updates in environments where SSE connections are established with external or untrusted sources. Regular dependency audits and automated patching pipelines are essential to prevent exposure to such logic-based denial of service vulnerabilities that bypass traditional size-limit defenses.