CVE-2026-109924: Node.js Undici Library DOS Vulnerability

CVE-2026-109924 Overview

CVE-2026-109924 is a denial-of-service vulnerability in undici, an HTTP client library for Node.js maintained by the OpenJS Foundation. The flaw resides in the EventSource client, which handles Server-Sent Events (SSE). A malicious or compromised SSE peer can drive the parser to exhaust process memory and terminate the Node.js process. The maxEventSize and maxResponseSize byte limits fail to bound retained per-field and per-chunk parser state, and maxResponseSize is enforced against the compressed body rather than the decompressed payload. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Any Node.js application that maintains an EventSource connection to an untrusted peer can be forced into memory exhaustion and process termination, resulting in availability loss.

Affected Products

undici versions 6.5.0 through 6.29.0
undici versions 7.0.0 through 7.30.0
undici versions 8.0.0 through 8.12.1

Discovery Timeline

2026-10-15 - CVE-2026-109924 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-109924

Vulnerability Analysis

The vulnerability affects the EventSource client within undici, which parses Server-Sent Events streams delivered over HTTP. The parser accumulates state for each incoming field and chunk as it reconstructs event records. That retained state is independent of the byte-oriented safety limits the library exposes to callers. An attacker-controlled SSE peer can therefore keep the parser in a state where memory consumption grows without a corresponding increase in observed response bytes. Because the only requirement is an outbound EventSource connection to an untrusted origin, exploitation requires no authentication and no user interaction. Impact is limited to availability: the Node.js process is terminated when the operating system or runtime enforces memory limits.

Root Cause

Two flaws combine to create the condition. First, maxEventSize and maxResponseSize measure byte counts of event payloads and response bodies, but they do not bound the per-field or per-chunk bookkeeping the parser retains while processing them. Second, maxResponseSize is applied to the compressed response body before decompression. A small compressed stream can expand into substantially larger retained state once inflated. The result is unbounded allocation that bypasses the configured guardrails.

Attack Vector

An attacker who controls or compromises an SSE endpoint can deliver one of two payload shapes. The first consists of millions of tiny completed data fields emitted without a blank-line event separator, forcing the parser to accumulate field state indefinitely. The second consists of a single unfinished line split across many chunks, forcing the parser to retain per-chunk buffers. Either shape causes memory to grow until the Node.js process is terminated. No proof-of-concept exploit is publicly listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog.

See the GitHub Security Advisory GHSA-4qv8-2p9j-2685 for the maintainer's technical description.

Detection Methods for CVE-2026-109924

Indicators of Compromise

Node.js processes terminating with out-of-memory errors shortly after establishing EventSource connections to external hosts.
Sustained resident set size (RSS) growth in Node.js workers that maintain long-lived SSE subscriptions.
Inbound SSE streams containing abnormally high counts of data: fields without intervening blank lines, or very long single lines fragmented across many TCP segments.

Detection Strategies

Inventory application dependencies for undici versions in the affected ranges, including transitive dependencies pulled in by frameworks such as Next.js, Fastify, and the native Node.js fetch implementation.
Monitor runtime memory metrics for Node.js services that act as EventSource clients and alert on anomalous growth rates.
Inspect outbound SSE connections at the network layer for compressed response bodies with high expansion ratios.

Monitoring Recommendations

Collect and retain process-level memory and crash telemetry from Node.js workloads in centralized logging.
Alert on repeated unexpected process restarts of services known to consume Server-Sent Events.
Correlate EventSource connection endpoints with threat intelligence to identify connections to untrusted or newly observed hosts.

How to Mitigate CVE-2026-109924

Immediate Actions Required

Upgrade undici to version 6.29.1, 7.30.1, 8.12.2, or later across all affected applications and container images.
Audit transitive dependencies with npm ls undici or yarn why undici to find pinned or nested vulnerable versions.
Restrict EventSource clients to trusted SSE endpoints where feasible and remove unused SSE integrations.

Patch Information

The maintainers fixed the issue in undici6.29.1, 7.30.1, and 8.12.2 by bounding the retained parser state independently of the existing byte-based limits. Refer to the OpenJS Foundation Security Advisories and GitHub Security Advisory GHSA-4qv8-2p9j-2685 for authoritative patch details.

Workarounds

No workaround is available. The vendor explicitly states that upgrading is the only remediation.
As a compensating control, isolate Node.js services that consume untrusted SSE streams in dedicated processes with enforced memory limits so that crashes do not affect other workloads.

bash

# Upgrade undici to a fixed release
npm install undici@^8.12.2
# or, for the 7.x line
npm install undici@^7.30.1
# or, for the 6.x line
npm install undici@^6.29.1

# Verify no vulnerable versions remain in the dependency tree
npm ls undici