CVE-2026-109869: Denial of Service via Orphaned Stream in Node.js Undici Fetch Implementation

Vulnerability ID: CVE-2026-109869

CVSS Score: 7.5

Published: 2026-10-23

CVE-2026-109869 is a high-severity denial-of-service vulnerability in undici, the default HTTP/1.1 client and Fetch implementation for Node.js. When a server responds with more than five Content-Encoding directives and prematurely closes the connection before transmitting the body, undici allocates an internal Readable stream before enforcing the content-encoding limit. Upon rejecting the fetch promise, the stream is orphaned without an error listener or abort signal, causing the premature socket closure to emit an unhandled stream error that terminates the Node.js process.

TL;DR

An unhandled error on an orphaned internal Readable stream in undici's fetch() implementation allows a remote HTTP server to crash the entire Node.js process by sending more than five Content-Encoding headers and closing the connection prematurely, bypassing…