CVE-2026-109924: Unbounded Memory Allocation in Node.js Undici EventSource Stream Parser

Vulnerability ID: CVE-2026-109924

CVSS Score: 5.9

Published: 2026-10-23

A resource allocation vulnerability (CWE-770) exists in the Server-Sent Events (SSE) parser within the Node.js undici HTTP client library. In affected versions, the EventSourceStream implementation fails to restrict the count of internal Buffer chunk references and accumulated string nodes prior to event dispatch boundaries. A malicious or compromised SSE endpoint can exploit this behavior by streaming fragmented, unterminated lines or continuous sequences of short data fields without empty separator lines, bypassing configured byte-size limits and causing a fatal Out-of-Memory (OOM) crash in the client Node.js process.

TL;DR

Node.js undici versions prior to 6.29.1, 7.30.1, and 8.12.2 contain an unbounded memory allocation flaw in the EventSource stream parser.…