All vulnerabilities

npm

CVE-2026-109924

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Severity: Medium 5.9
Published: 23 Oct 2026
Last changed: 23 Oct 2026
Added to UpHeron: 24 Oct 2026
Fixed in: 6.29.1, 7.30.1, 8.12.2
Also known as: GHSA-4qv8-2p9j-2685
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
undicinpm · `osv:npm:undici`	From 6.5.0 before 6.29.1 From 7.0.0 before 7.30.1 From 8.0.0 before 8.12.2

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-109924
GitHub Advisory Database https://github.com/advisories/GHSA-4qv8-2p9j-2685