CVE-2026-109924

Name of the Vulnerable Software and Affected Versions undici versions 6.5.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1

Description The EventSource client in this Node.js HTTP client library can be forced to exhaust process memory by a malicious Server-Sent Events peer. This occurs when a peer sends millions of small completed data fields without blank event separators, or a single unfinished line split across numerous chunks. The parser accumulates per-field and per-chunk state that is not restricted by maxEventSize or maxResponseSize limits. Additionally, because maxResponseSize is applied to the compressed body before decompression, a small compressed response can expand into a volume of retained memory sufficient to terminate the process. This affects applications maintaining an EventSource connection to an untrusted peer and impacts system availability.

Recommendations Update versions 6.5.0 through 6.29.0 to 6.29.1 or later. Update versions 7.0.0 through 7.30.0 to 7.30.1 or later. Update versions 8.0.0 through 8.12.1 to 8.12.2 or later.