{"vulnerability": "CVE-2026-109869", "sightings": [{"uuid": "83a6ff8c-c2fa-47ff-85b9-8773aa19a926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-109869", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117446332734779459", "content": "CVE-2026-109869 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109869https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929chttps://cna.openjsf.org/security-advisories.html#undici#CVE_2026_109869#bot", "creation_timestamp": "2026-10-15T18:26:58.737075Z"}]}