CVE-2026-109924 undici CVE debrief

Who should care

Node.js developers and administrators using the undici library, especially those using versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, should assess their exposure and upgrade to a fixed version.

Why it matters

A vulnerability in the undici library for Node.js could allow a Denial of Service (DoS) attack via unbounded memory usage in the EventSource parser. Node.js developers and administrators should assess their exposure and upgrade to a fixed version.

• Potential Denial of Service (DoS) attacks via unbounded memory usage
• Need to upgrade to a fixed version of undici to prevent potential DoS attacks
• Monitoring for potential DoS attacks targeting undici users
• Verification of undici version usage in affected applications

Technical summary

The undici library's EventSource parser does not properly bound retained parser state, leading to potential DoS attacks. An attacker could exploit this by sending a large number of small data fields or a single unfinished line split across many chunks, potentially leading to process termination. This issue affects versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 of the undici library. Node.js developers and administrators should assess their exposure and upgrade to a fixed version, such as 6.29.1, 7.30.1, or 8.12.2, or later.

Defensive priority

Upgrade to undici version 6.29.1, 7.30.1, or 8.12.2, or later, to address the vulnerability.

Recommended defensive actions

• Upgrade to undici version 6.29.1, 7.30.1, or 8.12.2, or later
• Review and update affected applications to use the latest version of undici
• Monitor for potential DoS attacks targeting undici users
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and fixed versions. The undici library's EventSource parser does not properly bound retained parser state, leading to potential DoS attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.