CVE-2026-18149: 
Grafana vulnerability analysis and mitigation

CVE-2026-18149 is a Denial of Service vulnerability in undici's RetryHandler that can leave an already-exposed response body pending indefinitely, exhausting application concurrency or memory. It affects undici versions 7.11.0 up to (but not including) 7.29.1, and 8.0.0 up to (but not including) 8.10.2. The vulnerability was published on September 4, 2026, and has a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is a missing release of resource after its effective lifetime (CWE-772), combined with improper update of reference count (CWE-911). When a server returns a successful response declaring a Content-Length, sends only part of the body, and closes the connection, undici's RetryHandler retries the request. If the retry returns a non-retryable status (e.g., HTTP 400), the handler forwards the new response downstream and replaces its internal response stream — but the original response body held by the application is never ended or destroyed. Critically, the configured bodyTimeout does not fire because its timer is tied to the connection parser rather than the orphaned body, meaning calls such as response.body.text() hang indefinitely. An attacker-controlled server can trigger this condition with just two short responses without maintaining a persistent connection (GitHub Advisory).

Repeated exploitation causes pending promises and streams to accumulate in the affected application, which can exhaust application concurrency or memory, resulting in a Denial of Service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications using undici as an HTTP client that communicate with attacker-controlled or compromised upstream servers are at risk (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to control or compromise a server that the vulnerable undici client communicates with, which raises the attack complexity (rated High). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory, Red Hat).

1. Control a server: Set up or compromise a server that the target application communicates with via undici (e.g., a third-party API endpoint or a man-in-the-middle position).
2. Send a truncated successful response: Respond to the client's HTTP request with a 2xx status code and a Content-Length header, but send only a partial body before closing the connection, causing undici's RetryHandler to trigger a retry.
3. Respond with a non-retryable status: On the retried request, respond with a non-retryable status code such as HTTP 400. The RetryHandler forwards this new response downstream and replaces its internal stream, orphaning the original response body.
4. Repeat to accumulate resources: Repeat steps 2–3 for each incoming request from the target application. Each cycle leaves a pending, unsettled response body and associated stream in the application's memory.
5. Achieve Denial of Service: As pending promises and streams accumulate without being released or timed out, the application's concurrency pool and/or memory are exhausted, causing it to become unresponsive (GitHub Advisory).

• Application Behavior: Increasing number of hung or never-resolving HTTP response body reads (e.g., response.body.text() calls that never settle); application threads or async tasks blocked indefinitely.
• Memory: Steadily growing heap memory usage in the Node.js process without corresponding garbage collection relief; high count of unresolved Promise objects visible in heap snapshots.
• Logs: Absence of expected response completion log entries for outbound HTTP requests; no bodyTimeout errors logged despite requests appearing to stall.
• Network: Outbound connections to upstream servers that are established and then closed by the remote side with incomplete response bodies; repeated retry attempts to the same endpoint in rapid succession (GitHub Advisory).

Users should upgrade to undici version 7.29.1 (for the v7 branch) or 8.10.2 (for the v8 branch), which contain the official patches. As a temporary workaround prior to upgrading, impose an independent request deadline at the application level and explicitly destroy the response body when that deadline expires — note that bodyTimeout alone does not prevent this issue. Additionally, monitoring for unusual memory consumption or concurrency exhaustion patterns can help detect exploitation attempts during the upgrade window (GitHub Advisory, Red Hat).

The advisory was published by maintainer mcollina on the GitHub Security Advisory page (GHSA-pmjh-fq2x-6v4x) on September 4, 2026, with UlisesGascon credited as remediation reviewer. Red Hat has tracked the issue via Bugzilla. No significant broader media coverage or notable community commentary beyond the official advisory has been observed at this time (GitHub Advisory, Red Hat).