CVE-2026-18149
published 2026-09-04CVE-2026-18149: undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.36%
28.6th percentile
undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| grafana | grafana | — | — |
| nodejs | undici | >= 7.11.0 < 7.29.1 | 7.29.1 |
| nodejs | undici | >= 8.0.0 < 8.10.2 | 8.10.2 |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift4 | ose-monitoring-plugin-rhel9 | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-lightspeed-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
undici: undici: Denial of Service due to orphaned response body in retry handler
vendor_redhat·2026-09-04·CVSS 5.9
CVE-2026-18149 [MEDIUM] CWE-911 undici: undici: Denial of Service due to orphaned response body in retry handler
undici: undici: Denial of Service due to orphaned response body in retry handler
A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: openshift-pipelines/pipelines-console-plugin-pf5-rhel9 (OpenShift Pipelines) - Fix deferred
Package: openshift-pipelines/pipelines-console-plugin-rhel9 (OpenShift Pipelines) - Fix
GHSA
undici vulnerable to Denial of Service via orphaned RetryHandler response body
ghsa·2026-09-29
CVE-2026-18149 [MEDIUM] CWE-772 undici vulnerable to Denial of Service via orphaned RetryHandler response body
undici vulnerable to Denial of Service via orphaned RetryHandler response body
### Impact
undici's `RetryHandler` can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original `response.body` held by the application is never settled, so reads such as `response.body.text()` hang and `bodyTimeout` does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.
### Patches
Patched in undici v7.29.1 and v8.10.2.
### Workarounds
Impose an independent request deadline and destroy the response body when it expires. `bodyTimeout` alone does not prevent this.
VulDB
nodejs undici up to 7.29.0/8.10.1 Retry resource consumption
vuldb·2026-09-04·CVSS 5.9
CVE-2026-18149 [MEDIUM] nodejs undici up to 7.29.0/8.10.1 Retry resource consumption
A vulnerability classified as problematic has been found in nodejs undici up to 7.29.0/8.10.1. Affected by this issue is some unknown functionality of the component Retry Handler. The manipulation leads to resource consumption.
This vulnerability is referenced as CVE-2026-18149. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18149 nodejs24: undici: Denial of Service due to orphaned response body in retry handler [fedora-all]
bugzilla·2026-09-07·CVSS 5.9
CVE-2026-18149 [MEDIUM] CVE-2026-18149 nodejs24: undici: Denial of Service due to orphaned response body in retry handler [fedora-all]
CVE-2026-18149 nodejs24: undici: Denial of Service due to orphaned response body in retry handler [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still h
Bugzilla
CVE-2026-18149 undici: undici: Denial of Service due to orphaned response body in retry handler
bugzilla·2026-09-04·CVSS 5.9
CVE-2026-18149 [MEDIUM] CVE-2026-18149 undici: undici: Denial of Service due to orphaned response body in retry handler
CVE-2026-18149 undici: undici: Denial of Service due to orphaned response body in retry handler
undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled ser
2026-09-04
Published