CVE-2026-109869: Denial of Service via Orphaned Stream in Node.js Undici Fetch Implementation

Vulnerability ID: CVE-2026-109869
CVSS Score: 7.5
Published: 2026-10-23

CVE-2026-109869 is a high-severity denial-of-service vulnerability in undici, the default HTTP/1.1 client and Fetch implementation for Node.js. When a server responds with more than five Content-Encoding directives and prematurely closes the connection before transmitting the body, undici allocates an internal Readable stream before enforcing the content-encoding limit. Upon rejecting the fetch promise, the stream is orphaned without an error listener or abort signal, causing the premature socket closure to emit an unhandled stream error that terminates the Node.js process.

TL;DR

An unhandled error on an orphaned internal Readable stream in undici's fetch() implementation allows a remote HTTP server to crash the entire Node.js process by sending more than five Content-Encoding headers and closing the connection prematurely, bypassing application-level try/catch blocks.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-109869 (GHSA-xjj6-f33q-929c)
• Weakness Class: CWE-248 (Uncaught Exception) / CWE-459 (Incomplete Cleanup)
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• EPSS Score: 0.343% (26.66th percentile)
• Attack Vector: Network (Malicious HTTP response with >5 Content-Encoding headers)
• Impact: Denial of Service (Unhandled stream error crashes Node.js process)
• Exploit Status: Proof of Concept (PoC) available
• CISA KEV Status: Not Listed

Affected Systems

• undici (npm package)
• Node.js runtime global fetch() implementation
• undici: >= 6.23.0, < 6.29.1 (Fixed in: 6.29.1)
• undici: >= 7.18.0, < 7.30.1 (Fixed in: 7.30.1)
• undici: >= 8.0.0, < 8.12.2 (Fixed in: 8.12.2)

Code Analysis

Commit: b5084c7

Primary fix commit for v8.x / main branch: defer Readable stream creation and call controller.abort() on excessive content-encodings

@@ -2280,8 +2280,6 @@ async function httpNetworkFetch (
             appendHeadersListFromResponseHeaders(headersList, headers, rawHeaders)
             const location = headersList.get('location', true)

-            this.body = new Readable({ read: () => controller.resume() })
-
             const willFollow = location && request.redirect === 'follow' &&
               redirectStatusSet.has(status)

@@ -2299,7 +2297,7 @@ async function httpNetworkFetch (
               // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
               const maxContentEncodings = 5
               if (codings.length > maxContentEncodings) {
-                reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
+                controller.abort(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
                 return
               }

@@ -2341,6 +2339,8 @@ async function httpNetworkFetch (
               }
             }

+            this.body = new Readable({ read: () => controller.resume() })
+
             const onError = (err) => this.onResponseError(controller, err)

             resolve({

Commit: 07ded49

Backport fix commit for v7.x branch (released in v7.30.1)

Commit: 1325a87

Backport fix commit for v6.x branch (released in v6.29.1)

Mitigation Strategies

• Upgrade undici to a patched version (6.29.1, 7.30.1, or 8.12.2) across all application dependencies and Node.js runtime environments.
• Restrict outbound HTTP/HTTPS requests from Node.js applications to trusted, allowlisted upstream domains using network egress controls.
• Inspect and normalize upstream HTTP responses via an egress forward proxy to block responses with excessive Content-Encoding headers.

Remediation Steps:

1. Run npm ls undici (or equivalent for yarn/pnpm) to identify all direct and transitive versions of undici in your project.
2. Update package.json and lockfiles to require undici >= 6.29.1 (for v6.x), >= 7.30.1 (for v7.x), or >= 8.12.2 (for v8.x).
3. If using Node.js global fetch(), verify the bundled undici version via process.versions.undici and update the Node.js runtime or override global fetch with a patched undici package.
4. Verify the remediation by running regression tests ensuring responses with >5 Content-Encoding headers reject cleanly without crashing on premature socket closure.

References

• GitHub Security Advisory: GHSA-xjj6-f33q-929c
• National Vulnerability Database (NVD): CVE-2026-109869
• CVE.org Record: CVE-2026-109869
• OpenJS Foundation Security Advisories
• CVEProject cvelistV5 Record: CVE-2026-109869.json
• Undici Fix Commit (v8 / main): b5084c7dc239172d75c336b1cd51ddac023938a5
• Undici Fix Commit (v7 branch): 07ded4941b1e72afec862958c3b8ddf468f3b429
• Undici Fix Commit (v6 branch): 1325a87dfb3492f8e87e6b0a84b3bda4e82e3436
• Undici Release Tag v8.12.2
• Undici Release Tag v7.30.1
• Undici Release Tag v6.29.1

Read the full report for CVE-2026-109869 on our website for more details including interactive diagrams and full exploit analysis.