{"id":"CVE-2026-84947","aliases":["GHSA-2gqq-gqf2-x968"],"url":"https://o3.security/vulnerability/CVE-2026-84947","summary":"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor","details":"### Impact\n\nundici's `interceptors.dump()` reads and discards response bodies up to a configurable `maxSize`. When a response declares a `Content-Length` that exceeds `maxSize`, the request is aborted cleanly. When a response is sent chunked (no `Content-Length`) and its body exceeds `maxSize`, it is not aborted: the interceptor ends the response early once the accumulated size reaches `maxSize`, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading `200` with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected.\n\n### Patches\n\nUpgrade to `7.29.1` or `8.10.2`. The dump interceptor now enforces `maxSize` on both the declared and the received body size, aborting the request with a `RequestAbortedError` instead of returning a truncated response.\n\n### Workarounds\n\nNone. Avoid using `interceptors.dump()` with untrusted upstreams until upgraded.","published":"2026-09-04T16:53:11.716Z","modified":"2026-10-21T02:30:24.014987452Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"7.29.1"},{"ecosystem":"npm","name":"undici","fixedVersion":"8.10.2"}],"fix":{"url":"https://github.com/nodejs/undici/commit/21693f406f0142f3504192e9f9b022dcf84782ae","label":"nodejs/undici@21693f4"},"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84947.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/21693f406f0142f3504192e9f9b022dcf84782ae"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/6d583124e7cf60b640097d64144ed633cc450584"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:24.014987452Z"}}