Skip to content
Heist/ feed
LowFix available

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Type: advisorySource: OSV1 source record

### Impact undici's `interceptors.dump()` reads and discards response bodies up to a configurable `maxSize`. When a response declares a `Content-Length` that exceeds `maxSize`, the request is aborted cleanly. When a response is sent chunked (no `Content-Length`) and its body exceeds `maxSize`, it is not aborted: the interceptor ends the response early once the accumulated size reaches `maxSize`, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading `200` with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected. ### Patches Upgrade to `7.29.1` or `8.10.2`. The dump interceptor now enforces `maxSize` on both the declared and the received body size, aborting the request with a `RequestAbortedError` instead of returning a truncated response. ### Workarounds None. Avoid using `interceptors.dump()` with untrusted upstreams until upgraded.

Announced Source revision 1
Original source ↗

GHSA-2gqq-gqf2-x968

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-2gqq-gqf2-x968

undici

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
7.29.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

undici

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
8.10.2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "7.1.0"
          },
          {
            "fixed": "7.29.1"
          }
        ]
      }
    ],
    "package": {
      "name": "undici",
      "purl": "pkg:npm/undici",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2gqq-gqf2-x968/GHSA-2gqq-gqf2-x968.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "8.0.0"
          },
          {
            "fixed": "8.10.2"
          }
        ]
      }
    ],
    "package": {
      "name": "undici",
      "purl": "pkg:npm/undici",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2gqq-gqf2-x968/GHSA-2gqq-gqf2-x968.json"
    }
  }
]
Related CVEs
CVE-2026-84947

Source reference: /aliases

Publisher severity

low

Source reference: /database_specific/severity

Event
#31148 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement