CVE-2026-109869 · GHSA-xjj6-f33q-929c
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- Risk score
- 60/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undi…
- Affected
- undici (npm) >= 6.23.0, < 6.29.1; undici (npm) >= 7.18.0, < 7.30.1; undici (npm) >= 8.0.0, < 8.12.2
- Fix
- Upgrade undici to 6.29.1 or 7.30.1 or 8.12.2 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
Undici: Amber, patch this week. undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-suppl…
The flaws
- CVE-2026-109869: Undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (CVSS 7.5 · EPSS 0%)
- CVE-2026-109383: Undici is an HTTP client library for Node.js (CVSS 9.1 · EPSS 0%)
- CVE-2026-109829: Undici is an HTTP client library for Node.js (CVSS 9.1 · EPSS 0%)
- CVE-2026-109932: Undici is an HTTP client library for Node.js (CVSS 7.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Undici
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-248 (CWE-248). 63 other warnings in 30 days
- Same product: Earlier undici warnings. 5 in the last 90 days
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| undici | npm | >= 6.23.0, < 6.29.1 | 6.29.1 |
| undici | npm | >= 7.18.0, < 7.30.1 | 7.30.1 |
| undici | npm | >= 8.0.0, < 8.12.2 | 8.12.2 |
References
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c
- https://github.com/advisories/GHSA-xjj6-f33q-929c
- https://nvd.nist.gov/vuln/detail/CVE-2026-109869
- https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429
- https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436
- https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5
- https://github.com/nodejs/undici/releases/tag/v6.29.1
- https://github.com/nodejs/undici/releases/tag/v7.30.1
- https://github.com/nodejs/undici/releases/tag/v8.12.2
Original description
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.
Last activity 23 Oct 2026. Patch Forecast updates every hour.