{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"node-undici","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NPYS2DXRC024JPF7W3G8S7","modified_at":"2026-10-23T18:05:32.005828278Z","published_at":"2026-10-15T19:17:22.180Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-109924","https://security-tracker.debian.org/tracker/CVE-2026-109924"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-109924#Debian:14/node-undici","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-109924"}],"summary":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a mali"}