Memory Exhaustion Vulnerability in undici HTTP Client Library for Node.js

CVE-2026-109924

What is CVE-2026-109924?

The undici HTTP client library for Node.js contains a vulnerability in the EventSource client, which can lead to memory exhaustion. When connected to a malicious Server-Sent Events peer, an application can be forced to retain excessive memory by sending millions of tiny data fields without proper event separation or fragmented incomplete lines. This behavior causes the parser to retain an increasing amount of state information, ultimately leading to process termination due to memory exhaustion. Affected versions of undici were 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1. The issue has been addressed in versions 6.29.1, 7.30.1, and 8.12.2, encouraging users to upgrade promptly to ensure stability and security.

References