CVE-2026-109924

A flaw was found in undici. A malicious server can trigger a Denial of Service (DoS) by exhausting application memory. When an application connects to an untrusted Server-Sent Events (SSE) feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or repeated message fields. This allows an attacker to send crafted or compressed responses that consume excessive memory and terminate the application process.

This vulnerability is rated Moderate rather than Important because exploitation requires a Node.js client application to actively connect to an untrusted or compromised Server-Sent Events endpoint. In standard Red Hat product deployments, applications typically consume trusted, internal network services rather than arbitrary external feeds. Additionally, the impact is strictly confined to process termination from resource exhaustion, with no compromise to data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.