npm: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

npm: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser vulnerability discovered by ? in WordPress npm undici versions = 6.5.0, 6.29.1...

CVE-2026-109924

A flaw was found in undici. A malicious server can trigger a Denial of Service DoS by exhausting application memory. When an application connects to an untrusted Server-Sent Events SSE feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or...

CVE-2026-109924 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

CVE-2026-109924

The undici HTTP client library for Node.js (versions 6.5.0-6.29.0 , 7.0.0-7.30.0 , and 8.0.0-8.12.1 ) contains a vulnerability in its EventSource client. A malicious or compromised Server-Sent Events (SSE) peer can trigger a Denial of Service (DoS) by exhausting process memory. The root cause is ...