Improper exception handling vulnerability in expressjs body-parser

Versions of expressjs body-parser prior to 1.20.9 and from 2.0.0 up to but not including 2.4.0 contain an improper exception handling vulnerability. This vulnerability arises when a request containing Content-Encoding is pipelined into an decompression stream; after reading the request body, this...

CLEANSTART-2026-ZU45548 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

CVE-2026-84890 affects multiple packages. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. See references for individual vulnerability details...

SUSE CVE-2026-109869

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

EUVD-2026-103292

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

CVE-2026-111924

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

CVE-2026-111924: Improper Handling of Highly Compressed Data (Data Amplification)

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

Fleet Device Management Fleet Resource Management Error Vulnerability

Fleet Device Management versions prior to 4.83.0 have a resource management vulnerability. This vulnerability arises when an unauthenticated attacker can send highly compressed requests with the Content-Encoding: gzip header to unauthenticated endpoints. Upon decoding, the request body expands,...

UBUNTU-CVE-2026-109869

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

Linux Distros Unpatched Vulnerability : CVE-2026-109869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crash...

Uncaught Exception

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via excessive Content-Encoding headers in an HTTP response processed by httpNetworkFetch in lib/web/fetch/index.js. A server returning ...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via excessive Content-Encoding headers in an HTTP response processed by httpNetworkFetch in lib/web/fetch/index.js. A server returning a response with...

DEBIAN-CVE-2026-109869

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

CVE-2026-109869

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

CVE-2026-109869

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

CVE-2026-109869 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

CVE-2026-109869

The undici HTTP client library for Node.js is vulnerable to a Denial of Service (DoS) in versions 6.23.0 through 6.29.0 , 7.18.0 through 7.30.0 , and 8.0.0 through 8.12.1 . The fetch() implementation fails to handle internal response streams correctly when a malicious server provides more than fi...

CVE-2026-109869

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

CVE-2026-109869: Uncaught Exception

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

PT-2026-115098

Name of the Vulnerable Software and Affected Versions undici versions 6.23.0 through 6.29.0 undici versions 7.18.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The fetch implementation crashes the Node.js process when a remote, unauthenticated server returns a response containi...