undici CVE-2026-109924

The affected application must instantiate undici's EventSource client and keep a connection open to an untrusted or attacker-controlled Server-Sent Events (SSE) endpoint - the attacker controls only the response body, not the request. The attacker then sends either millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks; a small compressed response suffices because maxResponseSize is enforced before decompression. Exploitation is limited by the requirement that the victim already consumes SSE from the hostile peer (reflected in AC:H); it needs no authentication (PR:N), no user interaction (UI:N), and affects default configurations once an EventSource connection to the untrusted peer exists. There is no workaround other than upgrading to undici 6.29.1, 7.30.1, 8.12.2, or later.

This is a genuine but moderate-priority availability issue, and the CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures that profile: network-reachable and unauthenticated, but gated by high attack complexity and limited to availability impact only (no confidentiality or integrity loss). No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation - the signals that would elevate this to urgent patching are simply absent rather than negative. The AC:H rating is consistent with the description's precondition that the victim application must itself hold an EventSource connection open to an untrusted or compromised SSE peer; this is not a condition an attacker can unilaterally create against an arbitrary target, which meaningfully narrows the exploitable population below undici's very large install base. The realistic worst case is a single remote process crash (memory exhaustion / OOM kill) per vulnerable connection. Net: treat as a routine dependency upgrade for services that consume third-party SSE streams, not a drop-everything emergency, unless such untrusted EventSource usage is confirmed in the environment.

A Node.js service uses undici's EventSource client to subscribe to a third-party or user-configurable Server-Sent Events endpoint. A malicious or compromised SSE server returns a small compressed response that either contains millions of tiny completed data fields with no blank separators, or a single unfinished line split across many chunks; the parser accumulates unbounded per-field and per-chunk state (not capped by maxEventSize/maxResponseSize, since maxResponseSize is checked pre-decompression), exhausting process memory and terminating the Node.js process. No public exploit code is identified at time of analysis, and the AC:H rating reflects that the victim must already maintain an EventSource connection to the attacker-controlled peer.