GHSA-2gqq-gqf2-x968

Source

https://github.com/advisories/GHSA-2gqq-gqf2-x968

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2gqq-gqf2-x968/GHSA-2gqq-gqf2-x968.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2gqq-gqf2-x968

Aliases

CVE-2026-84947

Published

2026-09-29T18:18:51Z

Modified

2026-09-29T18:28:11Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Details

Impact

undici's interceptors.dump() reads and discards response bodies up to a configurable maxSize. When a response declares a Content-Length that exceeds maxSize, the request is aborted cleanly. When a response is sent chunked (no Content-Length) and its body exceeds maxSize, it is not aborted: the interceptor ends the response early once the accumulated size reaches maxSize, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading 200 with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected.

Patches

Upgrade to 7.29.1 or 8.10.2. The dump interceptor now enforces maxSize on both the declared and the received body size, aborting the request with a RequestAbortedError instead of returning a truncated response.

Workarounds

None. Avoid using interceptors.dump() with untrusted upstreams until upgraded.

Database specific

{
    "cwe_ids":  [
        "CWE-20",
        "CWE-248"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-29T18:18:51Z",
    "nvd_published_at":  "2026-09-04T17:17:02Z",
    "severity":  "LOW"
}

References

Affected packages

npm / undici

Package

Name: undici; View open source insights on deps.dev
Purl: pkg:npm/undici

Affected ranges

Type: SEMVER
Events: Introduced

7.1.0

Fixed

7.29.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2gqq-gqf2-x968/GHSA-2gqq-gqf2-x968.json"

npm / undici

Package

Name: undici; View open source insights on deps.dev
Purl: pkg:npm/undici

Affected ranges

Type: SEMVER
Events: Introduced

8.0.0

Fixed

8.10.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2gqq-gqf2-x968/GHSA-2gqq-gqf2-x968.json"