Uncontrolled Resource Consumption in ninenines gun HTTP Module

CVE-2026-43973

What is CVE-2026-43973?

The ninenines gun HTTP module suffers from an uncontrolled resource consumption vulnerability that occurs due to unbounded HTTP response buffering. Attackers can exploit this issue by sending partial HTTP responses that lack the necessary terminators, leading to excessive cumulative memory usage as the server continues to append incoming data without a limit. The vulnerability affects versions of gun from 1.0.0 to just before 2.4.0, posing a significant risk of out-of-memory crashes that can impact the entire server node.

References