Is CVE-2026-109924 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109924 being exploited in the wild.

How severe is CVE-2026-109924?

Medium severity, with a CVSS score of 5.9, published 15 October 2026.

Which products and versions are affected?

undici (npm) >= 6.5.0, < 6.29.1, SEMVER:introduced=6.5.0,fixed=6.29.1; OpenJS Foundation Undici 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1.

Is there a fix for CVE-2026-109924?

Yes. undici (npm): upgrade to 6.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109924 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109924?

Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109924: undici EventSource memory exhaustion denial of service

Q: Is there a fix for CVE-2026-109924?

Yes. undici (npm): upgrade to 6.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-109924 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-109924?

Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109924 · Severity: medium · CVSS 5.9 · Published 2026-10-15

undici is an HTTP client library for Node.js that handles Server-Sent Events (EventSource connections). A malicious or compromised server can exhaust the Node.js process's memory by sending specially crafted event data, causing the application to crash. This vulnerability only requires the application to maintain a connection to an untrusted server.

Technologies: undici (npm), OpenJS Foundation Undici. Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-109924 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109924 being exploited in the wild.
How severe is CVE-2026-109924?: Medium severity, with a CVSS score of 5.9, published 15 October 2026.
Which products and versions are affected?: undici (npm) >= 6.5.0, < 6.29.1, SEMVER:introduced=6.5.0,fixed=6.29.1; OpenJS Foundation Undici 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1.
Is there a fix for CVE-2026-109924?: Yes. undici (npm): upgrade to 6.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109924 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109924?: Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 6.29.1 or later
```
npm install undici@6.29.1
```

Technical details

The EventSource parser in undici retains unbounded per-field and per-chunk state when processing server-sent events, bypassing the byte-based maxEventSize and maxResponseSize limits. An attacker can trigger memory exhaustion by sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks. Since maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into sufficient retained memory to terminate the process.

Affected products

OpenJS Foundation undici 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1

Identifiers

CVE-2026-109924
GHSA-4qv8-2p9j-2685

Timeline

2026-10-15: disclosed
2026-10-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.