All vulnerabilities
CVE-2026-18149GHSA-pmjh-fq2x-6v4x

undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici undicinpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.29.1Also 8.10.2GitHub
Published4 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text() hang and bodyTimeout does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.

Patches

Patched in undici v7.29.1 and v8.10.2.

Workarounds

Impose an independent request deadline and destroy the response body when it expires. bodyTimeout alone does not prevent this.

Text from GitHub Advisory Database

Affected versions 8

  • undici, npm>= 7.11.0, < 7.29.1GitHub
  • undici, npm>= 8.0.0, < 8.10.2GitHub
  • undiciaffected: 7.11.0 before 7.29.1CVE List
  • undiciunaffected: 7.29.1CVE List
  • undiciaffected: 8.0.0 before 8.10.2CVE List
  • undiciunaffected: 8.10.2CVE List
  • undici, npmfrom 7.11.0, fixed in 7.29.1OSV
  • undici, npmfrom 8.0.0, fixed in 8.10.2OSV

References 9