Search: CVE-2026-109869

Node.js HTTP client library undici versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1 contain a vulnerability in the fetch() implementation. When a malicious server returns a response with more than five content codings and closes the connection before sending the body, the Node.js process crashes due to an unhandled error. This leads to a denial of service. The issue is fixed in versions 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to these or later versions. No workaround exists.