{"uuid": "cad0db6e-e773-41b3-aff6-a3f01921abc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-pmjh-fq2x-6v4x", "type": "seen", "source": "https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5", "content": "# CVE-2026-18149: CVE-2026-18149: Unresolved Response Body Hang in Undici RetryHandler\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-18149\n\n## Summary\nA resource management vulnerability in the Undici HTTP client (CWE-772) occurs when the retry interceptor receives a partial body payload followed by a non-retryable response error on a subsequent connection attempt, resulting in orphaned streams and potential Denial of Service (DoS).\n\n## TL;DR\nAn unmitigated resource leak in undici's RetryHandler causes application-level hangs and Denial of Service when handling aborted responses followed by non-retryable errors.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-772\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.9 (Medium)\n- **EPSS Score**: 0.0036 (0.36%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Undici HTTP client within 7.x and 8.x version branches.\n- **undici**: >= 7.11.0 < 7.29.1 (Fixed in: `7.29.1`)\n- **undici**: >= 8.0.0 < 8.10.2 (Fixed in: `8.10.2`)\n\n## Mitigation\n\n- Disable retry middleware configurations when interacting with untrusted or external APIs.\n- Implement client-side request timeout wrappers using AbortSignal to prevent indefinite stream hangs.\n- Enforce API gateways or reverse proxies to normalize and sanitize broken TCP connections before they reach application-level clients.\n\n**Remediation Steps:**\n1. Identify all projects and packages containing dependencies on Undici via `npm ls undici`.\n2. Upgrade Undici to version 7.29.1 or 8.10.2 depending on the respective release branch.\n3. Validate the patch behavior by deploying the reproduction test suite in target environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-pmjh-fq2x-6v4x](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [NVD CVE-2026-18149 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-18149)\n- [CVE.org CVE-2026-18149](https://www.cve.org/CVERecord?id=CVE-2026-18149)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-18149) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T23:30:32.000000Z"}