Node undici: In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by… (CVE-2026-109924)

The undici HTTP client library for Node.js has a vulnerability (CVE-2026-109924) in its EventSource client in versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1. A malicious or compromised Server-Sent Events peer can cause the client to exhaust process memory by sending millions of tiny completed data fields without blank event separators or a single unfinished line split across many chunks. The parser retains growing per-field and per-chunk state that is not bounded by the byte-based maxEventSize and maxResponseSize limits. Since maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. The only impact is availability loss. The vulnerability is fixed in undici versions 6.29.1, 7.30.1, and 8.12.2 by bounding the retained parser state independently of byte limits. Users should upgrade to these versions or later. No workaround is available.

The vulnerability allows an attacker controlling a Server-Sent Events peer to cause denial of service by exhausting the memory of the Node.js process running undici's EventSource client. This results in process termination and loss of availability. There is no impact on confidentiality or integrity.

A fix is available in undici versions 6.29.1, 7.30.1, and 8.12.2. Users should upgrade to one of these versions or later to remediate the vulnerability. There is no workaround.