{"id":"ghsa-ghsa-4qv8-2p9j-2685","seq":661290,"kind":"advisory","title":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser","url":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4qv8-2p9j-2685","summary":"影響: npm:undici >= 6.5.0, < 6.29.1 → 6.29.1, npm:undici >= 7.0.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2\nundici's EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data: fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state. The byte-based maxEventSize and maxResponseSize limits do not bound that retained state, and maxResponseSize is enforced on the compressed body before decompression, so a…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-109924"],"tags":["GHSA-4qv8-2p9j-2685","undici","undici","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:13:29.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}