Description
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.
Published: 2026-10-15
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update
AI Analysis

Impact

In undici, an HTTP client library for Node.js, the EventSource parser can be forced to consume unlimited memory. The flaw arises when a malicious Server‐Sent Events peer sends countless tiny completed data fields with no event separator, or a single unfinished line split across many chunks. The parser retains per‑field and per‑chunk state that is not bounded by the byte‑based maxEventSize and maxResponseSize limits, and because the size check occurs before decompression, a small compressed response can expand into enough retained memory to terminate the process. The result is an application crash or restart, destroying availability for users. This vulnerability represents an uncontrolled resource consumption weakness.

Affected Systems

undici:undici is affected. The vulnerability exists in versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and later releases.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; an attacker only needs to maintain an EventSource connection to an untrusted Server‑Sent Events peer and send crafted data. The problem can be reproduced by simply exercising the EventSource interface, so the conditions for exploitation are straightforward. Availability is the sole impact; confidentiality and integrity remain unaffected.

Generated by OpenCVE AI on October 16, 2026 at 06:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the undici package to version 6.29.1 or later, 7.30.1 or later, or 8.12.2 or later to apply the fix that bounds parser state independently of byte limits.
  • If your application must use EventSource, restrict connections to trusted servers or remove the EventSource usage entirely to eliminate the attack surface.
  • Deploy application monitoring that tracks memory consumption and alerts on abnormal growth to detect potential denial‑of‑service attempts early.

Generated by OpenCVE AI on October 16, 2026 at 06:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
History

Fri, 23 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Undici
Undici undici
Vendors & Products Undici
Undici undici

Mon, 19 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Nodejs
Nodejs undici
CPEs cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
Vendors & Products Nodejs
Nodejs undici

Fri, 16 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 15 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.
Title undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nodejs Undici
Undici Undici
cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-10-16T20:05:22.386Z

Reserved: 2026-10-13T10:00:53.642Z

Link: CVE-2026-109924

cve-icon Vulnrichment

Updated: 2026-10-16T20:05:14.956Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T19:17:22.180

Modified: 2026-10-19T20:45:00.433

Link: CVE-2026-109924

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-15T18:16:48Z

Links: CVE-2026-109924 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T13:15:14Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling