CVE-2026-18149

A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).

An attacker-controlled server can trigger a denial of service in applications using undici's retry handler. This vulnerability allows for resource exhaustion by leaving response bodies orphaned, which can lead to a degradation of service availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications utilizing undici should implement an independent request deadline and ensure the response body is explicitly destroyed upon expiration. The bodyTimeout mechanism alone is insufficient to prevent resource exhaustion in this scenario.