CVE-2026-18149 Nodejs CVE debrief

Who should care

Defenders and developers using undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2 should assess exposure and prioritize upgrading to undici 7.29.1 or 8.10.2. This includes operators, platform teams, vulnerability management teams, and security teams who manage undici deployments.

Why it matters

CVE-2026-18149 is a medium-severity vulnerability in undici's retry handler that can lead to exhaustion of application concurrency or memory. Defenders and developers using affected versions of undici should assess exposure and prioritize upgrading to undici 7.29.1 or 8.10.2.

• An attacker-controlled server can trigger this with two short responses without keeping a connection open, leading to accumulated pending promises and streams that can exhaust application concurrency or memory.
• Calls that read the response body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body.
• Defenders should verify if their systems are using affected versions of undici and prioritize upgrading to undici 7.29.1 or 8.10.2.

Technical summary

The undici retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed.

Defensive priority

Upgrade to undici 7.29.1 or 8.10.2 to address the undici retry handler issue.

Recommended defensive actions

• Upgrade to undici 7.29.1 or 8.10.2
• Review and update affected systems and applications
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The undici retry handler can leave an already-exposed response body pending forever when a server returns a successful response with a Content-Length, sends only part of the body, and closes the connection. This issue affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.