CVE-2026-109869

The undici HTTP client library for Node.js is vulnerable to a Denial of Service (DoS) in versions 6.23.0 through 6.29.0 , 7.18.0 through 7.30.0 , and 8.0.0 through 8.12.1 . The fetch() implementation fails to handle internal response streams correctly when a malicious server provides more than fi...

CVE-2026-109932

The undici HTTP client library for Node.js is vulnerable to a Denial of Service (DoS) attack due to unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. In affected versions (5.15.0 through 6.29.0 , 7.0.0 through 7.30.0 , and 8.0.0 through 8.12.1 ), a remote attacker can s...