{"id":"ghsa-ghsa-xjj6-f33q-929c","seq":661289,"kind":"advisory","title":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","url":"https://github.com/advisories/GHSA-xjj6-f33q-929c","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xjj6-f33q-929c","summary":"影響: npm:undici >= 6.23.0, < 6.29.1 → 6.29.1, npm:undici >= 7.18.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2\nundici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled err…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-109869"],"tags":["GHSA-xjj6-f33q-929c","undici","undici","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:14:31.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}