The retry handler in undici can leave an already‑exposed response body pending indefinitely. When a server replies successfully with a declared Content-Length but sends only part of the body and then closes the connection, the retry handler retries the request. If the retry returns a non‑retryable status such as 400, the handler forwards that new response while replacing its internal response stream, but the original application‑held response body is never ended or destroyed. As a result, any code that reads that body never resolves, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker‑controlled server can exploit this by sending two short responses without keeping a connection open. Repeated requests accumulate unclosed promises and streams, which can exhaust application concurrency or memory, ultimately causing the application to freeze or crash.

Undici, a popular HTTP client library for Node.js, is affected for all releases from version 7.11.0 through 7.29.1 and from 8.0.0 through 8.10.2. Any application that relies on these undici versions and performs HTTP requests that may trigger retries is impacted.

The CVSS score of 5.9 reflects moderate severity. EPSS is not available, indicating that public evaluation of exploitation probability is lacking. The vulnerability is not yet listed in the CISA KEV catalog. If exploited, the attack can reserve pending promises and streams until the application runs out of concurrency slots or memory, resulting in a denial of service. The attacker would need control over a server that the target application contacts, sending two short but distinct responses to trigger the retry and subsequent orphaned body. Once the flaw is triggered repeatedly, the application begins to accumulate orphaned resources. While no publicly documented exploit exists as of this report, the nature of the denial of service could be severe for high‑traffic or critical services that depend on undici for HTTP client functionality.