CVE-2026-109924

A flaw was found in undici. A malicious server can trigger a Denial of Service DoS by exhausting application memory. When an application connects to an untrusted Server-Sent Events SSE feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or...

CVE-2026-109924

The undici HTTP client library for Node.js is vulnerable to a Denial of Service (DoS) attack due to unbounded memory consumption in its EventSource parser . Specifically, versions 6.5.0 through 6.29.0 , 7.0.0 through 7.30.0 , and 8.0.0 through 8.12.1 are affected. A malicious or compromised Serve...