CVE-2026-84947: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
Impact
undici's interceptors.dump() reads and discards response bodies up to a configurable maxSize. When a response declares a Content-Length that exceeds maxSize, the request is aborted cleanly. When a response is sent chunked (no Content-Length) and its body exceeds maxSize, it is not aborted: the interceptor ends the response early once the accumulated size reaches maxSize, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading 200 with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected.
Patches
Upgrade to 7.29.1 or 8.10.2. The dump interceptor now enforces maxSize on both the declared and the received body size, aborting the request with a RequestAbortedError instead of returning a truncated response.
Workarounds
None. Avoid using interceptors.dump() with untrusted upstreams until upgraded.
Other sources
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.10.2 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.29.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.29.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.10.2 - Compensating control
Avoid using undici's interceptors.dump() with untrusted or misbehaving upstreams until upgraded.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using undici's dump interceptor are exposed when it processes a chunked response without a Content-Length whose body exceeds the interceptor's configured maximum size. The affected behavior can leave the application with a successful status but an empty or truncated body.
What must an attacker control to trigger the problem?
An attacker needs to cause the application to receive an oversized chunked response that omits Content-Length. The response body must continue delivering bytes after the dump interceptor reaches its configured maximum.
How can I identify signs that this has occurred?
Look for requests reported to the application as successful despite returning an empty or truncated response body, alongside a disconnected connection or aborted request. The internal assertion is triggered after a second completion signal is delivered.
What versions should be remediated?
The affected ranges are undici 7.1.0 through 7.29.1 and 8.0.0 through 8.10.2. The provided remediation guidance is to upgrade to undici 7.29.1 or 8.10.2.