undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

影響: npm:undici >= 6.23.0, < 6.29.1 → 6.29.1, npm:undici >= 7.18.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2

undici's fetch() crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled err…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 07:14, GitHub Advisory Database에서 "undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-109869.