CVE-2026-109924: Unbounded Memory Allocation in Node.js Undici EventSource Stream Parser

Vulnerability ID: CVE-2026-109924
CVSS Score: 5.9
Published: 2026-10-23

A resource allocation vulnerability (CWE-770) exists in the Server-Sent Events (SSE) parser within the Node.js undici HTTP client library. In affected versions, the EventSourceStream implementation fails to restrict the count of internal Buffer chunk references and accumulated string nodes prior to event dispatch boundaries. A malicious or compromised SSE endpoint can exploit this behavior by streaming fragmented, unterminated lines or continuous sequences of short data fields without empty separator lines, bypassing configured byte-size limits and causing a fatal Out-of-Memory (OOM) crash in the client Node.js process.

TL;DR

Node.js undici versions prior to 6.29.1, 7.30.1, and 8.12.2 contain an unbounded memory allocation flaw in the EventSource stream parser. Remote SSE servers can crash client applications via heap exhaustion by streaming fragmented chunks or continuous data lines without event boundaries.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: Allocation of Resources Without Limits or Throttling (CWE-770)
• Affected Component: undici EventSourceStream (lib/web/eventsource/eventsource-stream.js)
• Attack Vector: Network (Malicious Server-Sent Events HTTP Response Stream)
• CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
• EPSS Score: 0.32% (23.84th Percentile)
• Primary Impact: Denial of Service via V8 JavaScript Heap Out-of-Memory Crash
• Exploit Status: Proof-of-Concept in Repository Regression Tests
• CISA KEV Status: Not Listed

Affected Systems

• Node.js applications using the undici npm package (versions 6.5.0 to 6.29.0, 7.0.0 to 7.30.0, and 8.0.0 to 8.12.1)
• Node.js runtimes utilizing affected versions of undici for native EventSource connections
• undici: >= 6.5.0, < 6.29.1 (Fixed in: 6.29.1)
• undici: >= 7.0.0, < 7.30.1 (Fixed in: 7.30.1)
• undici: >= 8.0.0, < 8.12.2 (Fixed in: 8.12.2)

Code Analysis

Commit: 789ef26

Enforce parser item limits (maxBufferedChunks and maxDataLines) and track all field sizes in EventSourceStream.

Commit: 2991627

Official security fix commit for EventSourceStream memory exhaustion.

Commit: c43b23f

Backport of EventSourceStream parser item and byte bounding fix.

Commit: bb6cc0a

Backport of EventSourceStream parser item and byte bounding fix.

Mitigation Strategies

• Upgrade the undici npm package to a patched release (6.29.1, 7.30.1, or 8.12.2) across all application environments.
• Restrict outbound EventSource connections to trusted, allowlisted endpoints to prevent connections to attacker-controlled SSE servers.
• Disable HTTP compression on untrusted text/event-stream connections via egress proxies to prevent gzip decompression amplification.
• Monitor V8 heap utilization and configure process managers (Kubernetes, systemd, PM2) with memory limits and automated restart policies to maintain service availability.

Remediation Steps:

1. Audit project dependencies using 'npm list undici' to identify any direct or transitive installations of undici within ranges >=6.5.0 <6.29.1, >=7.0.0 <7.30.1, or >=8.0.0 <8.12.2.
2. Update package.json or package-lock.json to require undici >=6.29.1 (for v6), >=7.30.1 (for v7), or >=8.12.2 (for v8).
3. Run 'npm install' or 'npm update undici' and redeploy affected Node.js services.
4. Verify that explicit maxEventSize configurations in EventSource or stream options align with expected payload sizes.

References

• GitHub Security Advisory GHSA-4qv8-2p9j-2685
• National Vulnerability Database - CVE-2026-109924
• CVE.org Official Record - CVE-2026-109924
• OpenJS Foundation CNA Security Advisories
• CVEListV5 Official JSON Record for CVE-2026-109924
• GitHub Patch Commit 789ef26461c648480433846607154f52d74ec9ab

Read the full report for CVE-2026-109924 on our website for more details including interactive diagrams and full exploit analysis.