CVE-2026-109869 Overview
CVE-2026-109869 is a denial-of-service vulnerability in undici, the HTTP client library used by Node.js. The flaw affects the fetch() implementation in versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1. A remote, unauthenticated server can crash the entire Node.js process by returning a response with more than five content codings and closing the connection before sending a body. The crash occurs even when the application correctly handles the fetch() rejection, because the error surfaces on an orphaned internal stream that Node.js treats as unhandled.
Critical Impact
A single malicious HTTP response terminates the Node.js process, enabling trivial remote denial of service against any application that issues outbound fetch() calls.
Affected Products
- nodejs undici versions 6.23.0 through 6.29.0
- nodejs undici versions 7.18.0 through 7.30.0
- nodejs undici versions 8.0.0 through 8.12.1
Discovery Timeline
- 2026-10-15 - CVE-2026-109869 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-109869
Vulnerability Analysis
The vulnerability lives in the fetch() implementation of undici. When a server returns a response, undici enforces a limit on the number of content-encoding codings allowed. The library correctly rejects responses that exceed five codings. However, it constructs the internal response stream before performing the coding count check and then returns early without attaching an error listener or aborting the request.
When the attacker-controlled server closes the TCP connection before sending the response body, Node.js detects a content-length mismatch on the orphaned stream. Because no error handler is attached, Node.js promotes the condition to an unhandled error and terminates the process. The weakness is classified as [CWE-248] Uncaught Exception.
Application-level try/catch or Promise rejection handling around fetch() does not help. The error originates from a stream that was never returned to the caller, so there is no object on which userland code could register a listener.
Root Cause
The root cause is an ordering defect in fetch() response processing. The internal response stream is instantiated before the content-encoding limit check runs. When the check fails, the function returns without disposing of the stream or wiring up an error listener, leaving a stream whose lifecycle is no longer owned by any caller.
Attack Vector
Exploitation requires only that a vulnerable Node.js application issues an outbound HTTP request to a server the attacker controls or can influence. The malicious server replies with a response containing six or more comma-separated values in the Content-Encoding header and closes the socket before sending the body. A single response is sufficient to crash the process. Scenarios that commonly expose this include webhook consumers, server-side rendering fetches, URL preview services, and SSRF-adjacent code paths where a request target can be redirected to an attacker endpoint.
No authenticated session, user interaction, or privileged position on the network is required. See the GitHub Security Advisory GHSA-xjj6-f33q-929c for additional detail.
Detection Methods for CVE-2026-109869
Indicators of Compromise
- Unexpected Node.js process termination immediately following an outbound fetch() call, especially with messages referencing ERR_UNHANDLED_ERROR or content-length mismatches on an HTTP response stream.
- Inbound responses from external services containing a Content-Encoding header with six or more comma-separated codings.
- Repeated crash-restart cycles in Node.js workloads correlated with traffic to a specific upstream host.
Detection Strategies
- Inventory node_modules and lockfiles across build artifacts and running containers to flag undici versions in the vulnerable ranges, including transitive dependencies pulled in by frameworks that call fetch().
- Instrument process supervisors (systemd, pm2, Kubernetes probes) to capture exit codes and stderr tails for Node.js workers, so unhandled-error terminations are not silently masked by auto-restart.
- Add egress inspection or a forward proxy that logs response headers, enabling detection of anomalous Content-Encoding chains.
Monitoring Recommendations
- Alert on repeated Node.js process restarts within short windows for services that perform outbound HTTP requests.
- Track dependency drift in CI using software composition analysis to catch regressions back into vulnerable undici ranges.
- Correlate upstream HTTP response anomalies with worker crashes in centralized logging to isolate the triggering endpoint.
How to Mitigate CVE-2026-109869
Immediate Actions Required
- Upgrade undici to 6.29.1, 7.30.1, 8.12.2, or later across all applications and container images.
- Audit direct and transitive dependencies, since many frameworks and SDKs bundle undici internally and must also be refreshed.
- Rebuild and redeploy affected Node.js services; a package upgrade without redeploy leaves running processes vulnerable.
- Restrict outbound HTTP destinations where feasible, limiting fetch() targets to vetted hosts via an egress allowlist.
Patch Information
The maintainers fixed the defect in undici 6.29.1, 7.30.1, and 8.12.2. The patch reorders response processing so the content-encoding limit check runs before the internal stream is created, and ensures the stream is properly aborted and its errors handled on the rejection path. Refer to the OpenJS Foundation Security Advisories and GitHub Security Advisory GHSA-xjj6-f33q-929c for release notes.
Workarounds
- No workaround exists. The advisory explicitly states that upgrading is the only remediation.
- As a compensating control until patches are deployed, route outbound fetch() traffic through a trusted forward proxy that normalizes or rejects responses with excessive Content-Encoding codings.
# Upgrade undici to a fixed release
npm install undici@^8.12.2
# or for the 7.x line
npm install undici@^7.30.1
# or for the 6.x line
npm install undici@^6.29.1
# Identify vulnerable installations, including transitive dependencies
npm ls undici
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
