undici CVE-2026-18149

The target application must use undici versions 7.11.0-<7.29.1 or 8.0.0-<8.10.2 with the retry handler active - the vulnerability is not triggered by direct (non-retried) requests. The attacker must control, compromise, or man-in-the-middle the HTTP server that the undici client is connecting to; exploitation is not possible against servers the attacker does not control. The server must be capable of issuing two crafted responses in sequence: a partial 2xx with Content-Length and a subsequent non-retryable status (e.g., 400). No client-side authentication, user interaction, or special client configuration is required beyond retry being enabled. Exploitation is limited to the Node.js server/service process running the vulnerable undici version; it does not affect other systems or users of the same service except through availability degradation.

The CVSS 5.9 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflects the most important constraint: the attack requires an attacker-controlled (or MITM'd) server, which constitutes a non-trivial precondition that elevates AC to H and keeps this from being a generic internet-facing risk. Real-world risk is therefore concentrated in applications that fetch data from untrusted or third-party servers using undici with retry handlers. No CISA KEV listing and no public proof-of-concept exploit are known at time of analysis, and EPSS data is not provided - the vulnerability has no known active exploitation. However, the attack is mechanically simple (two short crafted HTTP responses suffice), and affected versions span both stable release trains (7.x and 8.x) of a core Node.js ecosystem library, increasing the realistic exposure surface. The availability impact is genuine: unbounded accumulation of pending promises and unfreed stream objects can crash or hang long-running Node.js services. The 'Information Disclosure' tag in the source metadata is incorrect - there is no confidentiality impact; this is a pure availability/DoS issue.

An attacker operates an HTTP server that a target Node.js application (using undici with retry enabled) connects to - for example, a third-party API endpoint or an upstream service in a proxy chain. The malicious server sends a 200 response declaring Content-Length but delivers only a partial body before closing the connection; undici's retry handler retries and the server responds with a 400. The original body stream is orphaned in the application process, and the attacker repeats this pattern rapidly across concurrent requests to accumulate unreleased streams and pending promises until the Node.js event loop stalls or the process runs out of memory.