Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84947— undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Quick assessment

Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

undici 的 dump 拦截器会读取并丢弃响应体，直到达到可配置的最大尺寸。当响应声明的 Content-Length 超过该最大值时，拦截器会正常中止处理；但当响应没有 Content-Length 且使用分块传输（chunked）时，拦截器会在累积大小达到最大值时过早地发出完成信号，既没有暂停请求，也没有中止请求。由于底层解析器继续提供响应体数据，会触发第二个完成信号，从而触发内部断言，导致请求被中止且连接被拆除。应用层最终观察到的状态是：一个看似成功的 HTTP 状态码，但响应体为空或被截断，而实际上底层

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1003 · OS Credential Dumping

Affected Version Matrix 4

VendorProduct Version RangeStatus
undici undici 7.1.0< 7.29.1 affected
7.29.1 unaffected
8.0.0< 8.10.2 affected
8.10.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84947

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
Source: CVE Program / CVE List V5
Vulnerability Description
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
undici undici 7.1.0 ~ 7.29.1 -

II. Public POCs for CVE-2026-84947

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84947

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-84947 (1)

Same Patch Batch · undici · 2026-09-04 · 11 CVEs total

CVE-2026-19534 7.5 HIGH undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
CVE-2026-85152 7.4 HIGH undici vulnerable to cross-origin cache poisoning via missing origin isolation in intercep
CVE-2026-84961 7.4 HIGH undici vulnerable to TLS certificate validation bypass via dropped connect options in Bala
CVE-2026-84933 6.5 MEDIUM undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
CVE-2026-85024 5.9 MEDIUM undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate
CVE-2026-85014 5.9 MEDIUM undici vulnerable to Denial of Service via WebSocketStream unclean close
CVE-2026-18149 5.9 MEDIUM undici vulnerable to Denial of Service via orphaned RetryHandler response body
CVE-2026-84890 5.9 MEDIUM undici vulnerable to Denial of Service via unbounded decompression of compressed responses
CVE-2026-85008 3.7 LOW undici vulnerable to caching and replay of unsafe HTTP method responses
CVE-2026-18540 3.7 LOW undici vulnerable to downstream response splitting via retry interceptor

IV. Related Vulnerabilities

Same product: undici
Same vendor: undici
Same weakness: CWE-20

V. Comments for CVE-2026-84947

No comments yet

Leave a comment