Zero Radar
← feed
HighVulnerabilityCVE-2026-109869updated 25 Oct 2026, 13:32 UTC

undici fetch() can crash Node.js process from a malicious server response

If your Node.js app fetches data from a website or API, a malicious server can send a specially crafted reply that makes your whole app shut down. Updating the undici library stops this.

Fixed in 6.29.1, 7.30.1, 8.12.2Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes6.29.1, 7.30.1, 8.12.2 · since 25 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Malicious serverControls the remote endpoint your app calls
  2. 2Crafted responseMore than five content codings, then early close
  3. 3fetch() in undiciCreates body stream before rejecting the response
  4. 4Unhandled errorOrphaned stream emits error with no listener
  5. 5Process crashesNode.js terminates the whole application
  6. ResultApplication process is terminated

What happened

undici's fetch() rejects responses with more than five content codings, but it creates an internal body stream before that check and does not attach an error listener. When the server closes the connection early, Node.js sees an unhandled 'error' event on the orphaned stream and terminates the process.

Why it is dangerous: A single response from a remote, unauthenticated server can crash the process, even if the application correctly catches the fetch() rejection. Any service that calls untrusted or attacker-controlled endpoints is at risk of denial of service.

Are you affected?

You are affected if you run undici 6.23.0 to before 6.29.1, 7.18.0 to before 7.30.1, or 8.0.0 to before 8.12.2 and use fetch() to call remote servers.

Package / productAffected versionsFixed in
undici · npm>= 6.23.0, < 6.29.16.29.1
undici · npm>= 7.18.0, < 7.30.17.30.1
undici · npm>= 8.0.0, < 8.12.28.12.2

What to do

  1. Update undici to 6.29.1, 7.30.1, or 8.12.2, matching your major version
  2. Check your lockfile and dependency tree for other copies of undici and update them too
  3. Restart your Node.js services after the update so the fix takes effect

Timeline

  1. 23 Oct 2026, 22:14 UTC
    Publicly disclosed
  2. 23 Oct 2026, 22:14 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-109869 · GHSA-xjj6-f33q-929c
CVSS
7.5 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 22:14 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

undici fetch() can crash Node.js process from a malicious server response · Zero Radar