undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109924 · Microsoft / collected KEV context

GHSA-4qv8-2p9j-2685

cve-program · CVE-2026-109924

• https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685
• https://cna.openjsf.org/security-advisories.html

osv · GHSA-4qv8-2p9j-2685

• https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685
• https://nvd.nist.gov/vuln/detail/CVE-2026-109924
• https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6
• https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab
• https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v6.29.1
• https://github.com/nodejs/undici/releases/tag/v7.30.1
• https://github.com/nodejs/undici/releases/tag/v8.12.2

No related operational record is retained in the current change model.