Intel

AIKIDO-2026-56238

undici is vulnerable to Improper Input Validation

Improper Input ValidationCVE-2026-84947 Published Sep 18, 2026

37

Low Risk

This Affects:

JSundici
7.1.0 - 7.29.0
Fixed in 7.29.1
8.0.0 - 8.10.1
Fixed in 8.10.2
Are you affected? Scan for Free

TL;DR

The dump interceptor discards a response body up to maxSize. For a chunked response with no Content-Length, it signals completion once that size is reached instead of aborting, then a second completion from the parser tears down the connection. The application observes a successful status with an empty or truncated body. The fix enforces maxSize on both declared and received size and aborts instead of returning a truncated response.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use interceptors.dump().

Background info

undici is vulnerable to Improper Input Validation in versions 7.1.0 - 7.29.0 and 8.0.0 - 8.10.1.

How to fix this

Upgrade the undici library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform