undici EUVD-2026-102240

The vulnerable application must use undici's fetch() implementation (an affected 6.23.0-6.29.0, 7.18.0-7.30.0, or 8.0.0-8.12.1 release, including Node.js builds bundling these) to make an outbound HTTP(S) request to a server the attacker controls or has compromised - e.g. calling third-party APIs/webhooks or any user-influenced URL (SSRF-style redirection also qualifies). The attacker-as-server returns a response specifying more than five content-encoding codings and closes the connection before sending the body. Limiting factor: this is a client-side flaw, so the attacker cannot reach a victim that never initiates a request to a malicious/compromised endpoint; however, standard mitigation is ineffective because the crash occurs even when the fetch() promise rejection is correctly caught. There is no workaround other than upgrading to 6.29.1, 7.30.1, or 8.12.2 or later.

All signals point to a genuine, well-characterized availability risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with pure availability impact and no confidentiality or integrity loss (CWE-248, uncaught exception), which is fully consistent with the description: a single crafted response crashes the Node.js process. One important nuance the raw vector obscures is directionality - undici is an HTTP client, so the attacker is the SERVER, not a typical inbound network attacker; exploitation requires the victim application to issue a fetch() to an attacker-controlled or compromised endpoint. The description's note that the crash occurs 'even when the application correctly catches the fetch() rejection' elevates real-world severity, because the usual defensive pattern does not help. No EPSS score, KEV listing, POC, or SSVC data was supplied, so exploitation-probability and automatability signals are unavailable and cannot be used to rank this against other 7.5 issues. Net assessment: a credible, easy-to-trigger DoS whose priority is driven mainly by how widely undici/Node fetch is deployed rather than by any confirmed in-the-wild activity.

A Node.js service that uses fetch()/undici to call an external API, webhook, or user-supplied URL is pointed at a server controlled by the attacker. That server returns one response declaring more than five content-encoding codings and then closes the connection before the body, triggering a content-length mismatch on an orphaned stream that Node treats as an unhandled error and terminates the process. No public exploit identified at time of analysis, but the trigger is a single trivially craftable HTTP response.