CVE-2026-109924

undici is an HTTP client library for Node.js.

Undici

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based…

15. Okt 2026

Ausgewertete Quellen

• Hersteller
  https://cna.openjsf.org/security-advisories.html
• NVD
  CVE-2026-109924
• GitHub
  https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685