Description
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | 7.1.0 – < 7.29.1, 8.0.0 – < 8.10.2 | 7.29.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.2.hum1 | RHSA-2026:66008 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.18.1-0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.16.0-1.24.18.1.0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.7.0-1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.19.0-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pi-coding-agent | 0.87.1-1.1 | openSUSE-SU-2026:11884-1 |
| openSUSE Leap 16.0 | pi-coding-agent | 1.0.4-bp160.1.1 | openSUSE-SU-2026:22111-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs24 +4 | 1:24.21.0-1.amzn2023.0.1 | ALAS2023-2026-3107 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 | ALAS2023-2026-3107 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.amzn2023.0.1 | ALAS2023-2026-3107 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.139.1-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r11 | — |
| Wolfi rolling | node-gyp | 13.0.2-r1 | — |
| Wolfi rolling | prism | 5.16.0-r14 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | >= 7.1.0, < 7.29.1 | 7.29.1 | GHSA-2gqq-gqf2-x968 |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 | GHSA-2gqq-gqf2-x968 |
Advisories 7
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:54389 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54438 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:66008 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:22111-1 Security update for pi-coding-agent SUSE / openSUSE Security Updates · Oct 19, 2026
- ALAS2023-2026-3107 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- openSUSE-SU-2026:11884-1 pi-coding-agent-0.87.1-1.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026