CVE-2026-84947 Overview
CVE-2026-84947 affects the dump interceptor in undici, the HTTP/1.1 client shipped with Node.js. The interceptor discards response bodies up to a configurable maximum size. When a server returns a chunked response without a Content-Length header, the interceptor signals completion early once the accumulated size hits the maximum. It fails to pause or abort the underlying request. The parser continues delivering bytes, fires a second completion signal, and trips an internal assertion that tears down the connection. The application observes a misleading successful status with an empty or truncated body while the connection is severed.
Critical Impact
Applications relying on undici's dump interceptor can silently receive truncated responses and disconnected sockets, undermining data integrity guarantees for HTTP clients.
Affected Products
- undici versions 7.1.0 through 7.29.0
- undici versions 8.0.0 through 8.10.1
- Node.js applications and libraries embedding vulnerable undici releases
Discovery Timeline
- 2026-09-04 - CVE-2026-84947 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84947
Vulnerability Analysis
The flaw is classified under [CWE-20] Improper Input Validation. The dump interceptor in undici is designed to read and discard response bodies up to a caller-defined maximum. Two code paths handle response termination differently. When a Content-Length header exceeds the maximum, the interceptor aborts cleanly. When the response is chunked and lacks Content-Length, the interceptor short-circuits by signaling completion once accumulated bytes reach the threshold. It does not pause or abort the HTTP request itself. The parser continues to deliver body bytes from the socket, which triggers a second completion signal. That second signal violates an internal invariant and trips an assertion that aborts the request and tears down the underlying TCP connection.
Root Cause
The root cause is asymmetric handling of length-delimited versus chunked responses in the dump interceptor. The chunked path emits an early completion event without instructing the parser or socket to stop delivering data. State reconciliation between the interceptor and the parser is missing, causing the second completion callback to violate assertions inside undici's request lifecycle.
Attack Vector
A network-adjacent attacker who controls or influences an upstream HTTP server can craft chunked responses that exceed the configured dump maximum size. When a vulnerable client issues a request that uses the dump interceptor, the attacker's response causes the interceptor to complete early, the parser to fire again, and the connection to be forcibly torn down. The calling application sees a successful status code with an empty or truncated body, masking the underlying failure. This can degrade the integrity of downstream logic that depends on complete response bodies or persistent connections.
No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-2gqq-gqf2-x968 for authoritative technical detail.
Detection Methods for CVE-2026-84947
Indicators of Compromise
- Application logs reporting successful HTTP responses with unexpectedly empty or truncated bodies from upstreams that use chunked transfer encoding.
- Abrupt socket disconnections or ERR_ASSERTION errors originating from undici request lifecycles.
- Increased rates of retry logic firing against endpoints that historically returned large chunked responses.
Detection Strategies
- Inventory Node.js applications and container images for vulnerable undici versions using software composition analysis tools.
- Instrument HTTP client code paths that call the dump interceptor and correlate response byte counts against declared or expected sizes.
- Review application error telemetry for undici assertion failures and unexpected connection resets.
Monitoring Recommendations
- Emit metrics on interceptor completion events versus underlying socket close events to catch state divergence.
- Alert on spikes in truncated responses from services known to stream chunked payloads.
- Track undici dependency versions in CI/CD build manifests and fail builds that pin vulnerable ranges.
How to Mitigate CVE-2026-84947
Immediate Actions Required
- Upgrade undici to version 7.29.1 or 8.10.2 across all Node.js applications and container images.
- Rebuild and redeploy downstream libraries and services that bundle a vulnerable undici release.
- Audit application code for direct or transitive use of the dump interceptor and validate response handling assumptions.
Patch Information
The undici maintainers released fixed versions 7.29.1 and 8.10.2. Details are published in GitHub Security Advisory GHSA-2gqq-gqf2-x968 and referenced by the OpenJS Foundation Security Advisories.
Workarounds
- Avoid using the dump interceptor against untrusted upstreams until patched versions are deployed.
- Enforce a strict Content-Length requirement on responses handled by dump, rejecting chunked responses at the application layer.
- Wrap dump invocations with explicit response size validation and treat truncated bodies as failed requests.
# Configuration example
npm install undici@8.10.2
# or for the 7.x line
npm install undici@7.29.1
npm ls undici
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
