CVE-2026-84947: undici Package Response Truncation Vulnerability
Summary
CVE-2026-84947: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor. Affects undici across 2 version ranges.
>= 7.1.0, < 7.29.1
>= 8.0.0, < 8.10.2
Fixed in 7.29.1 or 8.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The undici package is a high-performance HTTP/1.1 client designed for Node.js applications. It provides a streamlined interface for making HTTP requests and handling responses efficiently. However, it has a vulnerability that can lead to response truncation when dealing with oversized chunked responses, particularly when using the dump interceptor.
Vulnerability Detail
The vulnerability arises from the behavior of the undici package's interceptors.dump() method, which reads and discards response bodies up to a configurable maxSize. If a response declares a Content-Length exceeding maxSize, the request is aborted cleanly. However, if the response is sent in a chunked format (without a Content-Length header) and exceeds maxSize, the interceptor prematurely ends the response. This results in an internal assertion failure, leading to a request abort and connection tear-down. Consequently, applications may receive a misleading 200 status code with an empty or truncated body, posing a risk for applications relying on the dump interceptor against untrusted upstreams.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.1.0, < 7.29.17.29.1npm install undici@7.29.1 -
>= 8.0.0, < 8.10.28.10.2npm install undici@8.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid using the interceptors.dump() method with untrusted upstreams until you can upgrade to a patched version.
Conclusion
The undici package has a vulnerability that can lead to response truncation when using the dump interceptor with oversized chunked responses. It is crucial to upgrade to the patched versions to ensure the integrity of your application and avoid misleading responses.
See every vulnerability recorded for undici →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
Versions of undici starting from 7.1.0 up to 7.29.0 and from 8.0.0 up to 8.10.1 are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If left unaddressed, this vulnerability can lead to misleading responses from your application, potentially exposing it to further risks when interacting with untrusted upstream services.
Yes, you can mitigate the risk by avoiding the use of the interceptors.dump() method with untrusted upstreams until you can upgrade to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for undici.
