# CVE-2026-109924: undici EventSource memory exhaustion denial of service

Source: https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109924 · Severity: medium · CVSS 5.9 · Published 2026-10-15

undici is an HTTP client library for Node.js that handles Server-Sent Events (EventSource connections). A malicious or compromised server can exhaust the Node.js process's memory by sending specially crafted event data, causing the application to crash. This vulnerability only requires the application to maintain a connection to an untrusted server.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici), [OpenJS Foundation Undici](https://junglewise.ai/threats/technologies/openjs-foundation-undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-109924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109924 being exploited in the wild.

**How severe is CVE-2026-109924?** Medium severity, with a CVSS score of 5.9, published 15 October 2026.

**Which products and versions are affected?** undici (npm) >= 6.5.0, < 6.29.1, SEMVER:introduced=6.5.0,fixed=6.29.1; OpenJS Foundation Undici 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1.

**Is there a fix for CVE-2026-109924?** Yes. undici (npm): upgrade to 6.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109924 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109924?** Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 6.29.1 or later

  ```sh
  npm install undici@6.29.1
  ```


## Technical details

The EventSource parser in undici retains unbounded per-field and per-chunk state when processing server-sent events, bypassing the byte-based maxEventSize and maxResponseSize limits. An attacker can trigger memory exhaustion by sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks. Since maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into sufficient retained memory to terminate the process.

## Affected products

- OpenJS Foundation undici 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, 8.0.0 through 8.12.1

## Identifiers

- CVE-2026-109924
- GHSA-4qv8-2p9j-2685

## Timeline

- 2026-10-15: disclosed
- 2026-10-15: patched

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)

## Related threats

- [undici cross-user cache disclosure via same-origin redirect](https://junglewise.ai/threats/cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7)
- [undici Subresource Integrity bypass via whitespace in integrity metadata](https://junglewise.ai/threats/cve-2026-120423-undici-is-an-http-client-for-node-js-in-versions-7-15-0-through)
- [undici denial of service via unhandled exception in cache-interceptor](https://junglewise.ai/threats/cve-2026-120222-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7)
- [undici cache poisoning and cross-user disclosure via intermediate redirect](https://junglewise.ai/threats/cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12)
- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)