Node undici: undici's dump interceptor reads and discards a response body up to a configurable maximum size. (CVE-2026-84947)

CVE-2026-84947 describes a vulnerability in the undici HTTP client library's dump interceptor component. When handling chunked HTTP responses without a declared Content-Length header, if the response body size exceeds a configured maximum size, the interceptor prematurely terminates the response. This results in the application receiving a 200 OK status with a truncated or empty response body, potentially misleading the application logic. This affects applications using the dump interceptor with untrusted or misbehaving upstream servers. The issue is fixed in undici versions 7.29.1 and 8.10.2.

The vulnerability causes response truncation leading to integrity issues where the application may process incomplete or empty response bodies while believing the response is successful (HTTP 200). There is no impact on confidentiality or availability. This can affect application behavior relying on full response data from upstream servers, especially when those servers are untrusted or malfunctioning.

Upgrade undici to version 7.29.1 or later in the 7.x series, or 8.10.2 or later in the 8.x series to apply the official fix. No other mitigation is indicated by the vendor advisory. Applications using the dump interceptor should ensure they are running on patched versions to avoid response truncation issues.