GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

• npm undici: >= 6.23.0, < 6.29.1 → fixed in 6.29.1 • npm undici: >= 7.18.0, < 7.30.1 → fixed in 7.30.1 • npm undici: >= 8.0.0, < 8.12.2 → fixed in 8.12.2

Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled `error` and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the `fetch()` rejection. undici 6.x, 7.x, and 8.x are affected. Patches Upgrade to `6.29.1`, `7.30.1`, or `8.12.2`. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream. Workarounds None.