CVE-2026-109869

A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.

This vulnerability is rated as an Important severity because an unauthenticated remote server can trigger an unhandled runtime error that abruptly terminates the parent Node.js process, bypassing application-level catch blocks. In Red Hat products and containerized workloads running affected Node.js runtimes, the flaw impacts services executing outbound HTTP calls to untrusted or external third-party endpoints. Conversely, deployments where applications only interact with verified internal endpoints or do not fetch content from untrusted remote hosts are not exposed to this denial-of-service condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.