Node.js undici DoS via orphaned stream: CVE-2026-109869

CVE-2026-109869 (CVSS 7.5) in undici, Node.js's default HTTP client and fetch implementation, lets a remote server crash the process. A response with more than five Content-Encoding headers followed by a premature connection close leaves an internal Readable stream orphaned without an error listener. Fixed in undici 6.29.1, 7.30.1 and 8.12.2.

• CVSS 7.5: unhandled stream error terminates the Node.js process
• Attack: response with over 5 Content-Encoding headers and early close
• Affects undici 6.23.0–6.29.0, 7.18.0–7.30.0 and 8.0.0–8.12.1
• Patched in 6.29.1, 7.30.1 and 8.12.2; PoC available