Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-84947 EUVD-2026-71517GHSA-2gqq-gqf2-x968

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Published Sep 4, 2026 · Updated Sep 4, 2026 · Assigned by openjs

Description

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

Affected products

VendorProductAffectedFixed
undici undici 7.1.0 – < 7.29.1, 8.0.0 – < 8.10.2 7.29.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-undici 8.10.2+dfsg+~cs3.2.2-1 —
Debian 13 node-undici No fix yet —
Debian 12 node-undici No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-undici No fix yet —
Ubuntu 26.04 LTS node-undici No fix yet —
Ubuntu 24.04 LTS node-undici No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grafana12.4 12.4.10-0.2.hum1 RHSA-2026:66008
Red Hat Hardened Images 1 nodejs24 +6 24.18.1-0.2.2.hum1 RHSA-2026:54438
Red Hat Hardened Images 1 nodejs24-npm 11.16.0-1.24.18.1.0.2.2.hum1 RHSA-2026:54438
Red Hat Hardened Images 1 nodejs26 +6 26.7.0-1.5.2.hum1 RHSA-2026:54389
Red Hat Hardened Images 1 nodejs26-npm 11.19.0-1.26.7.0.1.5.2.hum1 RHSA-2026:54389
Red Hat Hardened Images 1 v8-14.6-devel 14.6.202.34-1.26.7.0.1.5.2.hum1 RHSA-2026:54389
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed pi-coding-agent 0.87.1-1.1 openSUSE-SU-2026:11884-1
openSUSE Leap 16.0 pi-coding-agent 1.0.4-bp160.1.1 openSUSE-SU-2026:22111-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs24 +4 1:24.21.0-1.amzn2023.0.1 ALAS2023-2026-3107
Amazon Linux 2023 nodejs24-npm 1:11.19.0-1.24.21.0.1.amzn2023.0.1 ALAS2023-2026-3107
Amazon Linux 2023 v8-13.6-devel 3:13.6.233.17-1.24.21.0.1.amzn2023.0.1 ALAS2023-2026-3107

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling code-server 4.139.1-r2 —
Wolfi rolling lerna 10.0.1-r11 —
Wolfi rolling node-gyp 13.0.2-r1 —
Wolfi rolling prism 5.16.0-r14 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm undici >= 7.1.0, < 7.29.1 7.29.1 GHSA-2gqq-gqf2-x968
npm undici >= 8.0.0, < 8.10.2 8.10.2 GHSA-2gqq-gqf2-x968

Advisories 7

References