CVE-2026-18149

Name of the Vulnerable Software and Affected Versions undici versions 7.11.0 through 7.29.0 undici versions 8.0.0 through 8.10.1

Description The retry handler can leave a response body pending indefinitely. This occurs when a server provides a successful response with a Content-Length but closes the connection after sending only part of the body. If a subsequent retry returns a non-retryable status (such as 400), the handler forwards the new response and replaces the internal response stream, leaving the original response body held by the application neither ended nor destroyed. Consequently, calls reading that body never settle, and the body timeout fails to trigger because the timer is linked to the connection parser rather than the orphaned body. An attacker-controlled server can exploit this by sending two short responses to accumulate pending promises and streams, potentially exhausting application memory or concurrency, leading to a Denial of Service (DoS), which is a condition where a service is unavailable to its intended users.

Recommendations Upgrade to version 7.29.1 for versions in the 7.x branch. Upgrade to version 8.10.2 for versions in the 8.x branch.