undici's retry handler can leave an already-exposed response body pending forever.

CVE-2026-18149 is a resource-leak flaw in undici's retry handler (CWE-772). When a server sends a partial response with a declared Content-Length, closes the connection, and the retry handler retries the request but receives a non-retryable status (e.g. 400), the handler replaces the internal stream with the new response but never ends or destroys the original response body the application is still holding. The body timeout never fires because its timer is bound to the connection parser, not the orphaned stream. Affected versions are undici 7.11.0 through 7.29.0 and 8.0.0 through 8.10.1. Fixed in 7.29.1 and 8.10.2.

The vendor's MEDIUM / 5.9 rating is honest and arguably slightly generous. The CVSS vector sets Attack Complexity to High (AC:H) because the attacker must control the HTTP server the victim application connects to, the retry interceptor must be explicitly configured (it is not on by default), and the impact ceiling is availability-only — no confidentiality or integrity impact. In real-world terms, this narrows the exploitable population to Node.js services that (a) use undici’s retry interceptor and (b) fetch URLs from untrusted or user-supplied origins. That’s a meaningful subset but far from universal.

Why this verdict

• Attacker-controlled server prerequisite: The attacker must control the HTTP endpoint the victim connects to. This is not a listening-service vulnerability — the application must reach out to a malicious origin, which requires SSRF-like functionality or user-supplied URL fetching.
• Opt-in retry interceptor: undici’s retry handler is not enabled by default. Applications must explicitly configure it, narrowing the vulnerable population to a subset of undici users.
• Availability-only impact: The CVSS vector confirms C:N/I:N/A:H. There is no path from this bug to code execution, privilege escalation, or data compromise. Process restarts fully remediate the DoS condition.
• Role multiplier: undici is bundled in Node.js and used in CI/CD runners, API gateways, and production services. In high-value roles (CI/CD fetching package URLs, API gateways proxying upstream), a successful DoS would disrupt a single process instance. The blast radius is host-level at worst (process crash), not domain/fleet/supply-chain scale. No role produces an outcome above application-level DoS, so no floor override applies.
• No exploitation evidence: No KEV listing, no public PoC, no campaign reports. EPSS is expected to be low.

Why not higher?

There is no path to code execution, privilege escalation, or data exfiltration. The impact is strictly availability and limited to the process level — a crashed Node.js process restarts in seconds via PM2 or systemd. The attacker cannot leverage this for lateral movement or persistence, and the two compounding prerequisites (attacker-controlled server + opt-in retry config) dramatically narrow the exploitable population.

Why not lower?

The vulnerability is still network-reachable (AV:N) and requires no authentication or user interaction. In applications that do fetch untrusted URLs with the retry interceptor (webhook handlers, URL preview services, RSS aggregators), the attack is low-effort for the attacker once preconditions are met. A sustained DoS against a single-instance service could cause real downtime. The 5.0 score acknowledges this residual risk.

1. Disable or remove the retry interceptor where not business-critical — If your application does not strictly need undici’s retry interceptor, removing it from the dispatcher chain eliminates the vulnerability entirely. Audit your codebase for new RetryHandler() or retry: in dispatcher options. No mitigation SLA applies at MEDIUM — go straight to remediation.
2. Allowlist outbound request targets — Restrict the set of URLs your application can fetch to known-good origins. Use an allowlist of domains or IP ranges for any user-influenced URL fetching (webhooks, previews, imports). This blocks the attacker-controlled-server prerequisite.
3. Set aggressive timeouts and concurrency limits on outbound HTTP — Configure headersTimeout, bodyTimeout, and maxConcurrentStreams on undici pools. While the body timeout doesn’t fire for orphaned streams (that’s the bug), overall pool exhaustion limits will cap the blast radius.
4. Upgrade undici to 7.29.1 or 8.10.2 — The definitive fix. Run npm audit fix or pin the patched version directly. For Node.js core bundled undici, upgrade Node.js to the next patch release that bundles the fix. Target completion within the noisgate 365-day remediation SLA for MEDIUM.

Run this on any host where a Node.js application using undici is deployed. Execute as the application user or any user with read access to node_modules. Example: bash check_cve_2026_18149.sh /opt/myapp

#!/usr/bin/env bash
# check_cve_2026_18149.sh - Check for CVE-2026-18149 (undici retry handler resource leak)
# Usage: bash check_cve_2026_18149.sh <project_dir>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
RESULT="UNKNOWN"

if ! command -v node &>/dev/null; then
  echo "UNKNOWN - node not found in PATH"
  exit 2
fi

# Check bundled undici in node_modules
PKG="${PROJECT_DIR}/node_modules/undici/package.json"
if [ -f "$PKG" ]; then
  VERSION=$(node -e "console.log(require('${PKG}').version)" 2>/dev/null || echo "")
else
  # Fall back to Node.js built-in undici
  VERSION=$(node -e "try{console.log(require('undici/package.json').version)}catch(e){console.log('')}" 2>/dev/null || echo "")
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - undici not found in ${PROJECT_DIR} or Node.js built-in"
  exit 2
fi

echo "Detected undici version: ${VERSION}"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Affected: 7.11.0 - 7.29.0, 8.0.0 - 8.10.1
# Fixed: 7.29.1+, 8.10.2+
if [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -lt 11 ]; then
    RESULT="PATCHED"  # Below affected range
  elif [ "$MINOR" -lt 29 ]; then
    RESULT="VULNERABLE"
  elif [ "$MINOR" -eq 29 ] && [ "$PATCH" -eq 0 ]; then
    RESULT="VULNERABLE"
  else
    RESULT="PATCHED"
  fi
elif [ "$MAJOR" -eq 8 ]; then
  if [ "$MINOR" -lt 10 ]; then
    RESULT="VULNERABLE"
  elif [ "$MINOR" -eq 10 ] && [ "$PATCH" -lt 2 ]; then
    RESULT="VULNERABLE"
  else
    RESULT="PATCHED"
  fi
else
  RESULT="PATCHED"  # v5, v6, v9+ not affected
fi

echo "$RESULT"
if [ "$RESULT" = "VULNERABLE" ]; then
  exit 1
elif [ "$RESULT" = "PATCHED" ]; then
  exit 0
else
  exit 2
fi

Sources

1. THREATINT CVE-2026-18149 Detail
2. GitHub Advisory - undici retry desync (GHSA-8xcm-r25x-g524)
3. undici npm package
4. undici GitHub repository
5. CWE-772: Missing Release of Resource after Effective Lifetime
6. FIRST EPSS FAQ
7. CISA KEV Catalog