CVE-2026-84947
Received Received - Intake

HTTP Request Handling DoS in Undici

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-84947
EUVD
EUVD-2026-71517

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
undici undici From 7.1.0 (inc) to 7.29.1 (inc)
undici undici From 8.0.0 (inc) to 8.10.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the undici library, which is used for HTTP requests. The dump interceptor reads response bodies up to a set size. If a response has no Content-Length and is chunked, the interceptor stops early at the size limit. This causes a second completion signal that disconnects the connection, leaving the app with a false success status and an empty or incomplete body.

Detection Guidance

Detection requires checking if your system uses vulnerable versions of undici (7.1.0 to 7.29.1 or 8.0.0 to 8.10.2). Inspect package.json or dependency files for undici versions. No direct commands are provided in the context.

Impact Analysis

You may receive misleading successful responses with missing or incomplete data. The underlying connection is actually closed, which could cause unexpected errors in your application. This affects applications using undici versions between 7.1.0-7.29.0 and 8.0.0-8.10.1.

Compliance Impact

This vulnerability may lead to data integrity issues by truncating response bodies, which could result in incomplete or missing data being processed or stored. For GDPR, this could affect the accuracy of personal data processing. For HIPAA, truncated data might compromise the integrity of protected health information.

Mitigation Strategies

Upgrade undici to version 7.29.1 or 8.10.2 or later. Remove or replace any affected versions in your project dependencies immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84947. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart