Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-04T17:21:46 undici: undici: Denial of Service due to orphaned response body in retry handler 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-911

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).

An attacker-controlled server can trigger a denial of service in applications using undici's retry handler. This vulnerability allows for resource exhaustion by leaving response bodies orphaned, which can lead to a degradation of service availability. Applications utilizing undici should implement an independent request deadline and ensure the response body is explicitly destroyed upon expiration. The bodyTimeout mechanism alone is insufficient to prevent resource exhaustion in this scenario. Red Hat Hardened Images 2026-08-12T00:00:00Z RHSA-2026:54389 nodejs26-main-26.7.0-1.5.2.hum1 Red Hat Hardened Images 2026-08-12T00:00:00Z RHSA-2026:54438 nodejs24-main-11.16.0-1.24.18.1.0.2.2.hum1 Red Hat Hardened Images 2026-09-09T00:00:00Z RHSA-2026:66008 grafana12-4-main-12.4.10-0.2.hum1 Exploit Intelligence Not affected exploit-intelligence/vulnerability-analysis-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat AMQ Broker 7 Not affected amq-broker-bin.zip Red Hat AMQ Broker 7 Not affected amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2 Not affected automation-platform-ui Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Fix deferred grafana Red Hat Enterprise Linux 10 Not affected nodejs22 Red Hat Enterprise Linux 10 Not affected nodejs24 Red Hat Enterprise Linux 10 Not affected nodejs26 Red Hat Enterprise Linux 10 Not affected ubi10/nodejs-24 Red Hat Enterprise Linux 10 Not affected ubi10/nodejs-24-minimal Red Hat Enterprise Linux 8 Not affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Not affected nodejs:24/nodejs Red Hat Enterprise Linux 8 Not affected ubi8/nodejs-24 Red Hat Enterprise Linux 8 Not affected ubi8/nodejs-24-minimal Red Hat Enterprise Linux 9 Not affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Not affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Not affected nodejs:26/nodejs Red Hat Enterprise Linux 9 Not affected ubi9/nodejs-24 Red Hat Enterprise Linux 9 Not affected ubi9/nodejs-24-minimal Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Will not fix nodejs25 Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-core-bff-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-operator-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Container Platform 4 Not affected wasmedge Red Hat Openshift Data Foundation 4 Not affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Not affected odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Not affected odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Not affected odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/pluginregistry-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/rhtas-console-ui-rhel9 Secrets Management Console for Red Hat OpenShift Not affected external-secrets-management/console-plugin-rhel9 Self-service automation portal 2 Not affected ansible-automation-platform/automation-portal Self-service automation portal 2 Not affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-18149 https://nvd.nist.gov/vuln/detail/CVE-2026-18149 https://cna.openjsf.org/security-advisories.html https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x