CVE-2026-109924

What it actually does

The EventSource parser in undici retains unbounded per-field and per-chunk state when a malicious SSE peer sends millions of tiny completed data fields lacking blank separators or a single unfinished line split across many chunks; byte-based maxEventSize and maxResponseSize limits do not constrain this growth and maxResponseSize is applied to the compressed body before decompression, allowing a small compressed response to expand into process-terminating memory consumption.

Why it matters to the business

An application maintaining an EventSource connection to an untrusted peer can be forced into denial of service, terminating the Node.js process and disrupting availability of any service that depends on undici-based HTTP clients; the flaw affects Red Hat nodejs24-main and nodejs26-main packages with CISA remediation deadlines not yet triggered and low exploit maturity.

How an attack unfolds

An attacker who controls or compromises an SSE server sends a crafted response containing either millions of tiny completed fields without separators or one long unfinished line delivered in many small chunks; the undici EventSource parser accumulates unbounded state that evades the existing size limits, exhausting memory and crashing the process; no authentication or user interaction is required beyond the victim maintaining the connection.

How to fix it

Upgrade undici to 6.29.1, 7.30.1 or 8.12.2 or later; for Red Hat nodejs24-main apply 24.21.0-1.5.hum1 (RHSA-2026:84706) and for nodejs26-main apply 26.12.1-0.1.hum1 (RHSA-2026:84706); no workaround exists.

How to confirm the fix worked

Confirm the installed undici or Red Hat nodejs package version meets or exceeds the fixed releases listed above; test EventSource connections against a server that emits the previously unbounded patterns and verify memory usage remains stable within configured limits.

Typical attack path

1. Attacker sets up or compromises an SSE endpoint that the target application connects to via undici EventSource
2. Attacker transmits a response consisting of millions of tiny completed data fields lacking blank event separators or a single unfinished line split across many chunks
3. Parser retains growing per-field and per-chunk state that exceeds available memory because limits are not applied to the retained parser structures
4. Process memory is exhausted, terminating the Node.js application and causing denial of service

How to detect it

Review application and system logs for unexpected Node.js process terminations or out-of-memory events on hosts running undici EventSource clients; correlate with network traffic showing large numbers of small SSE data chunks from external peers; examine process memory dumps or core files for signs of parser state accumulation if available.

What your security team should do

• Prioritize patching Red Hat nodejs24-main and nodejs26-main packages to the versions in RHSA-2026:84706 within normal change windows given the 11-day publication age and stable low EPSS
• Inventory all applications using undici EventSource against untrusted endpoints and schedule upgrades to 6.29.1/7.30.1/8.12.2 or later
• Monitor for future EPSS increases or KEV inclusion and adjust urgency accordingly