CVE-2026-84947

Name of the Vulnerable Software and Affected Versions undici versions 7.1.0 through 7.29.0 undici versions 8.0.0 through 8.10.1

Description The dump interceptor reads and discards response bodies up to a configurable maximum size. When a response is chunked and lacks a Content-Length, the interceptor signals completion early once the maximum size is reached without pausing or aborting the request. Since the underlying parser continues to deliver body bytes, a second completion signal triggers an internal assertion that aborts the request and terminates the connection. This results in the application receiving a misleading successful status with an empty or truncated body despite the connection being disconnected.

Recommendations Update undici versions 7.1.0 through 7.29.0 to version 7.29.1. Update undici versions 8.0.0 through 8.10.1 to version 8.10.2.