GHSA-4qv8-2p9j-2685
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4qv8-2p9j-2685
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4qv8-2p9j-2685/GHSA-4qv8-2p9j-2685.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4qv8-2p9j-2685
- Aliases
- Published
- 2026-10-23T22:13:29Z
- Modified
- 2026-10-23T22:30:04Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- Details
-
Impact
undici's
EventSourceclient can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completeddata:fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state. The byte-basedmaxEventSizeandmaxResponseSizelimits do not bound that retained state, andmaxResponseSizeis enforced on the compressed body before decompression, so a small compressed response can expand into enough retained memory to terminate the process. The application only needs to maintain anEventSourceconnection to an untrusted peer, which controls only the response. Availability is the only impact.Patches
Upgrade to
6.29.1,7.30.1, or8.12.2, which bound the retained EventSource parser state (the number ofdatafields and buffered chunks, the unfinished-line length, and per-field byte totals) independently of the byte limits.Workarounds
None.
- Database specific
{ "cwe_ids": [ "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2026-10-23T22:13:29Z", "nvd_published_at": "2026-10-15T19:17:22Z", "severity": "MODERATE" }- References
-
- https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685
- https://nvd.nist.gov/vuln/detail/CVE-2026-109924
- https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6
- https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab
- https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v6.29.1
- https://github.com/nodejs/undici/releases/tag/v7.30.1
- https://github.com/nodejs/undici/releases/tag/v8.12.2
Affected packages
npm / undici
Package
- Name
- undici
- View open source insights on deps.dev
- Purl
- pkg:npm/undici
npm / undici
Package
- Name
- undici
- View open source insights on deps.dev
- Purl
- pkg:npm/undici
npm / undici
Package
- Name
- undici
- View open source insights on deps.dev
- Purl
- pkg:npm/undici