Data Handling Flaw in undici Affects Node.js Applications

CVE-2026-18149

What is CVE-2026-18149?

The undici library features a flaw in its retry handler that can lead to an unresolvable response body remaining in memory. When a server responds with a Content-Length and fails to deliver the full body before closing the connection, the retry mechanism may issue further requests. If these retries yield non-retryable statuses, the library improperly handles the original response, causing the response body to linger indefinitely. This can escalate to unmanageable memory use and concurrency issues as response bodies accumulate without resolution. Specifically, versions 7.11.0 through 7.29.1 and 8.0.0 through 8.10.2 are vulnerable, necessitating an upgrade to version 7.29.1 or 8.10.2 to mitigate risks.

References