undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
### Impact undici's `interceptors.dump()` reads and discards response bodies up to a configurable `maxSize`. When a response declares a `Content-Length` that exceeds `maxSize`, the request is aborted cleanly. When a response is sent chunked (no `Content-Length`) and its body exceeds `maxSize`, it is not aborted: the interceptor ends the response early once the accumulated size reaches `maxSize`, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading `200` with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected. ### Patches Upgrade to `7.29.1` or `8.10.2`. The dump interceptor now enforces `maxSize` on both the declared and the received body size, aborting the request with a `RequestAbortedError` instead of returning a truncated response. ### Workarounds None. Avoid using `interceptors.dump()` with untrusted upstreams until upgraded.
GHSA-2gqq-gqf2-x968
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-2gqq-gqf2-x968
undici
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 7.29.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
undici
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 8.10.2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.29.1"
}
]
}
],
"package": {
"name": "undici",
"purl": "pkg:npm/undici",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2gqq-gqf2-x968/GHSA-2gqq-gqf2-x968.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.10.2"
}
]
}
],
"package": {
"name": "undici",
"purl": "pkg:npm/undici",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2gqq-gqf2-x968/GHSA-2gqq-gqf2-x968.json"
}
}
]- Related CVEs
- CVE-2026-84947
Source reference:
/aliases
Publisher severity
low
Source reference: /database_specific/severity
- Event
- #31148 · Revision 1
- Added to Heist Feed
- Publisher date