CVE-2026-18149: undici Denial of Service via Orphaned RetryHandler Response Body

Background

undici is a high-performance HTTP/1.1 client designed for Node.js, known for its speed and efficiency in handling HTTP requests. It provides features such as connection pooling, automatic retries, and support for streaming. However, a recent vulnerability has been identified that can lead to denial of service under certain conditions.

Vulnerability Detail

The vulnerability arises from undici's RetryHandler, which can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response body remains unsettled. This can cause operations like response.body.text() to hang indefinitely, and the bodyTimeout does not trigger. A malicious server can exploit this behavior by repeatedly sending such responses, leading to an accumulation of unresolved promises and streams, ultimately resulting in a denial of service.

npm install undici@8.12.3

Workaround

As a temporary workaround, impose an independent request deadline and ensure that the response body is destroyed when it expires. This can be implemented in your code as follows:

const response = await undici.request(url);
const bodyTimeout = setTimeout(() => {
  response.body.destroy();
}, 5000); // Set timeout to 5 seconds

response.body.text().then(text => {
  clearTimeout(bodyTimeout);
  // Process text
}).catch(err => {
  // Handle error
});

Conclusion

The undici package has a vulnerability (CVE-2026-18149) that can lead to denial of service due to orphaned response bodies in its RetryHandler. It is crucial to update to the patched versions or implement workarounds to mitigate the risk. Regular monitoring with tools like Vulert can help maintain the security of your applications.

See every vulnerability recorded for undici →

FAQ