undici: fetch() DoS via unhandled error on excessive content-encodings (CVE-2026-109869)
Severity: high · Patch status: patched · Since 2026-10-15 · CVE-2026-109869
undici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses via its content-encoding limit but had already created the internal response stream and returned without attaching an error listener or aborting the request; the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response even if the application catches the fetch() rejection. undici 6.x, 7.x, and 8.x are affected. Fixed in 6.29.1, 7.30.1, and 8.12.2 by validating the content-encoding chain before creating the internal body stream. No workarounds exist.
What to do
- Upgrade undici to 6.29.1, 7.30.1, or 8.12.2 (or the patched version bundled in your Node.js runtime) as soon as possible
- Audit dependencies and lockfiles for vulnerable undici versions (>=6.23.0 <6.29.1, >=7.18.0 <7.30.1, >=8.0.0 <8.12.2) and rebuild/redeploy
- Check which undici version your Node.js release ships and upgrade the runtime if it bundles a vulnerable version
- Until patched, restrict fetch() calls to trusted upstream servers where feasible and monitor for process crashes/restarts
Fixed versions
- undici 6.29.1
- undici 7.30.1
- undici 8.12.2
Sources
All live incidents on Threat Watch
