GHSA-pmjh-fq2x-6v4x

Suggest an improvement
Source
https://github.com/advisories/GHSA-pmjh-fq2x-6v4x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pmjh-fq2x-6v4x/GHSA-pmjh-fq2x-6v4x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pmjh-fq2x-6v4x
Aliases
Downstream
CGA (24)
ECHO (1)
MINI (9)
Published
2026-09-29T18:22:34Z
Modified
2026-09-29T18:30:41Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
undici vulnerable to Denial of Service via orphaned RetryHandler response body
Details

Impact

undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text() hang and bodyTimeout does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.

Patches

Patched in undici v7.29.1 and v8.10.2.

Workarounds

Impose an independent request deadline and destroy the response body when it expires. bodyTimeout alone does not prevent this.

Database specific 
{
    "cwe_ids":  [
        "CWE-772"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-29T18:22:34Z",
    "nvd_published_at":  "2026-09-04T18:17:49Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / undici

Package

Name
undici
View open source insights on deps.dev
Purl
pkg:npm/undici

Affected ranges

Type
SEMVER
Events
Introduced
7.11.0
Fixed
7.29.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pmjh-fq2x-6v4x/GHSA-pmjh-fq2x-6v4x.json"

npm / undici

Package

Name
undici
View open source insights on deps.dev
Purl
pkg:npm/undici

Affected ranges

Type
SEMVER
Events
Introduced
8.0.0
Fixed
8.10.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pmjh-fq2x-6v4x/GHSA-pmjh-fq2x-6v4x.json"