CVE-2026-84947 in Undici
Summary
by MITRE • 09/04/2026
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in the undici HTTP client library involves a critical logic error within its dump interceptor, which is designed to read and discard response bodies up to a configurable maximum size for efficiency purposes. This component handles two distinct types of HTTP responses: those with an explicit Content-Length header indicating a fixed body size, and chunked transfer-encoded responses where the length is not known in advance. While the implementation correctly aborts requests when the declared Content-Length exceeds the configured limit, it fails to manage the lifecycle of chunked streams properly once the accumulated byte count reaches that threshold. Instead of pausing or terminating the underlying stream parser cleanly, the interceptor signals completion prematurely without ensuring that the data source is stopped.
This flawed handling leads to a race condition where the underlying HTTP/1.1 parser continues to deliver body bytes even after the dump interceptor has already emitted its finish event. Because the interceptor does not pause consumption, these subsequent chunks are processed by an internal assertion mechanism designed to detect unexpected states during stream termination. The arrival of additional data triggers this assertion failure, causing the request object to abort and forcibly tear down the underlying network connection. This sequence represents a significant deviation from expected HTTP client behavior, as it conflates logical completion with physical disconnection without proper state management or resource cleanup protocols aligned with standard networking practices such as those defined in RFC 7230 for message framing.
The operational impact of this vulnerability is severe due to the misleading nature of the error presentation. Applications interacting with undici observe a successful status code and an empty or truncated response body, leading them to believe that the request completed normally despite the connection being abruptly closed by the library internals. This discrepancy between observed application state and actual network connectivity can cause silent data loss, incorrect business logic execution, or cascading failures in systems relying on accurate HTTP response validation. The lack of explicit error signaling means developers may not immediately recognize that a failure occurred, complicating debugging efforts and potentially allowing malformed responses to propagate through downstream services without detection.
From a security perspective, this issue aligns with CWE-829, which describes the inclusion of a function from an incorrect library or module, specifically manifesting here as improper control flow management within stream processing logic. It also relates to CWE-401 regarding memory and resource management errors, where resources are not released correctly due to premature termination signals. In terms of adversary behavior, this could be leveraged in denial-of-service scenarios if an attacker can trigger repeated connection teardowns against a high-throughput service, exhausting server-side connections or causing latency spikes for other users. The ATT&CK framework categorizes such resource exhaustion techniques under T1499, Endpoint Denial of Service, particularly when exploited to degrade system availability through inefficient resource handling.
To mitigate this vulnerability, organizations must upgrade undici to version 7.29.1 or 8.10.2 immediately, as these releases contain the necessary patches to correctly handle chunked stream termination and prevent premature completion signals from triggering internal assertions. Developers should also review their application logic for any assumptions about response body completeness when using dump interceptors, ensuring that critical data is not discarded without verification of full transmission integrity. Implementing robust error handling around HTTP requests can help detect unexpected connection closures early, allowing applications to retry or fail gracefully rather than proceeding with incomplete data. Regular updates to third-party dependencies remain the primary defense against such implementation flaws in widely used network libraries.