An internal response stream is created in undici’s fetch() before validating the number of content encodings. When a malicious server sends a response with more than five content‑codings and closes the connection before the body is transmitted, undici rejects the response after the stream has already been created. The early close causes a content‑length mismatch on an orphaned stream; Node.js treats this as an unhandled error and terminates the process. The flaw allows remote, unauthenticated attackers to trigger a fatal crash with a single crafted response, causing a denial of service even when the application correctly handles the fetch() rejection.

The issue affects the undici HTTP client library for Node.js in release ranges 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1. Users of these versions, regardless of the consuming application, are vulnerable.

This vulnerability has a CVSS score of 7.5, indicating a moderate to high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated; any Node.js application that reaches out to untrusted servers and uses undici’s fetch() is susceptible. Exploit requires no privileged access and can be performed with a single malicious HTTP response.