Live › vulnerability › CVE-2026-109869
Go to dashboardundici's fetch() crashes the Node.js process when a remote server sends a response with more than five content codings and closes the connection before the body. An attacker who controls or can impersonate an HTTP server the application fetches from can take the process down with one response.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 22:15 UTC, 1h before NVD. All times on this page are UTC.
Any Node.js application that calls fetch() or uses undici directly against servers it does not fully control, such as third-party APIs, webhooks targets, or user-supplied URLs. Applications that only call trusted internal services with fixed, controlled responses are much less exposed. Teams that pin a pre-6.23.0 or post-fixed version can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| undici | npm | >= 6.23.0, < 6.29.1 | 6.29.1 |
| undici | npm | >= 7.18.0, < 7.30.1 | 7.30.1 |
| undici | npm | >= 8.0.0, < 8.12.2 | 8.12.2 |
| nodejs undici | vendor | >= 6.23.0, < 6.29.1 | 6.29.1 |
| nodejs undici | vendor | >= 7.18.0, < 7.30.1 | 7.30.1 |
| nodejs undici | vendor | >= 8.0.0, < 8.12.2 | 8.12.2 |
npm ls undici in the project and check whether the resolved version falls in 6.23.0 to below 6.29.1, 7.18.0 to below 7.30.1, or 8.0.0 to below 8.12.2.node -p process.versions.undici if the application relies on global fetch.6.29.1, 7.30.1, or 8.12.2 matching the major line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
undici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection. undici 6.x, 7.x, and 8.x are affected.
Upgrade to 6.29.1, 7.30.1, or 8.12.2. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream.
None.
This page as .md · .json · in your agent: get_signal("CVE-2026-109869")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.