## undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-109869
- 公開日時: 2026-10-23T22:14:31.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-xjj6-f33q-929c)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-xjj6-f33q-929c

影響: npm:undici >= 6.23.0, < 6.29.1 → 6.29.1, npm:undici >= 7.18.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2
undici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled err…