Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109924— undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Quick assessment

Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

undici 是 Node.js 的 HTTP 客户端库。在 6.5.0 至 6.29.0、7.0.0 至 7.30.0，以及 8.0.0 至 8.12.1 版本中，其 EventSource 客户端可能因与恶意或已被攻陷的服务端事件（Server-Sent Events, SSE）对等方通信而导致进程内存耗尽。攻击者可以通过发送大量不含空白事件分隔符的微小已完成数据字段，或将单个未完成的行分割到多个数据块中，使解析器保留持续增长的状态信息（每字段和每数据块状态）。这些状态不受基于字节的 maxEventSize

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 6

VendorProduct Version RangeStatus
undici undici 6.5.0< 6.29.1 affected
6.29.1 unaffected
7.0.0< 7.30.1 affected
7.30.1 unaffected
8.0.0< 8.12.2 affected
8.12.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109924

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
Source: CVE Program / CVE List V5
Vulnerability Description
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
undici undici 6.5.0 ~ 6.29.1 -

II. Public POCs for CVE-2026-109924

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109924

请登录查看更多情报信息。

Other References for CVE-2026-109924 (1)

Same Patch Batch · undici · 2026-10-15 · 9 CVEs total

CVE-2026-109855 7.5 HIGH undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
CVE-2026-87018 7.5 HIGH undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
CVE-2026-109869 7.5 HIGH undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
CVE-2026-109383 7.4 HIGH undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
CVE-2026-109829 7.4 HIGH undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
CVE-2026-87029 5.9 MEDIUM undici vulnerable to Denial of Service via unhandled exception in the decompress intercept
CVE-2026-109932 5.9 MEDIUM undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffe
CVE-2026-109841 5.9 MEDIUM undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

IV. Related Vulnerabilities

Same product: undici
Same vendor: undici
Same weakness: CWE-770

V. Comments for CVE-2026-109924

No comments yet

Leave a comment