Detections
Analytics

SCA: security update for undici (GHSA-4qv8-2p9j-2685)

high Tenable Cloud Security Plugin ID 477206

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and
 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or
 compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event
 separator, or a single unfinished line split across many chunks, the parser retains a growing amount of
 per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound,
 and because maxResponseSize is enforced on the compressed body before decompression, a small compressed
 response can expand into enough retained memory to terminate the process. An application only needs to
 maintain an EventSource connection to an untrusted peer, which controls only the response, and
 availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the
 retained parser state independently of the byte limits, and users should upgrade to one of those versions
 or later. There is no workaround. (CVE-2026-109924)

Solution

Update the undici library and its related packages to version 6.29.1 or later.

See Also

https://github.com/advisories/GHSA-4qv8-2p9j-2685

Plugin Details

Severity: High

ID: 477206

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/24/2026

Updated: 10/24/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.7

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-109924

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-109924

IAVA: 2026-A-1200

cwe: CWE-770