undici is vulnerable to Improper Input Validation
37
CVE Score
Low
Improper Input Validation
The dump interceptor discards a response body up to maxSize. For a chunked response with no Content-Length, it signals completion once that size is reached instead of aborting, then a second completion from the parser tears down the connection. The application observes a successful status with an empty or truncated body. The fix enforces maxSize on both declared and received size and aborts instead of returning a truncated response.
Upgrade the undici library to the patch version.
You are affected if you are using a version that falls within the vulnerable range and you use interceptors.dump().
7.1.0 - 7.29.0
Fixed in 7.29.18.0.0 - 8.10.1
Fixed in 8.10.2undici is vulnerable to Improper Input Validation in versions 7.1.0 - 7.29.0 and 8.0.0 - 8.10.1.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.