Disclosure summary
### Impact undici's `RetryHandler` can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original `response.body` held by the application is never settled, so reads such as `response.body.text()` hang and `bodyTimeout` does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service. ### Patches Patched in undici v7.29.1 and v8.10.2. ### Workarounds Impose an independent request deadline and destroy the response body when it expires. `bodyTimeout` alone does not prevent this.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-pmjh-fq2x-6v4x
Open original source · Updated Sep 29, 2026
undici vulnerable to Denial of Service via orphaned RetryHandler response body
Source severity: MEDIUM / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | undici | >= 7.11.0, < 7.29.1 | 7.29.1 |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-09-29T14:22:34-04:00
MODIFIED 2026-09-29T14:22:35-04:00
INGESTED 2026-10-06T11:43:08-04:00