Denial of Service Vulnerability in undici HTTP Client Library

CVE-2026-109869

What is CVE-2026-109869?

The undici HTTP client library for Node.js contains a vulnerability that allows a remote, unauthenticated server to crash the Node.js process via a specially crafted HTTP response. This is triggered when more than five content codings are included in the server's response, which leads to a content-length mismatch on the internal response stream creation process. The application can properly handle fetch() rejections, but the lack of an abort mechanism or error listener means the Node.js process will terminate, causing a denial of service. Users are advised to upgrade to the patched versions 6.29.1, 7.30.1, or 8.12.2 to mitigate this issue.

References