Intel

AIKIDO-2026-56238

undici is vulnerable to Improper Input Validation

CVE-2026-84947Published Sep 18, 2026
September 18, 2026

37

CVE Score

Low

Improper Input Validation

Are you affected? Scan for Free

TL;DR

The dump interceptor discards a response body up to maxSize. For a chunked response with no Content-Length, it signals completion once that size is reached instead of aborting, then a second completion from the parser tears down the connection. The application observes a successful status with an empty or truncated body. The fix enforces maxSize on both declared and received size and aborts instead of returning a truncated response.

How do I fix this?

Upgrade the undici library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use interceptors.dump().

Package

Versions

7.1.0 - 7.29.0

Fixed in 7.29.1

8.0.0 - 8.10.1

Fixed in 8.10.2

Background info

undici is vulnerable to Improper Input Validation in versions 7.1.0 - 7.29.0 and 8.0.0 - 8.10.1.

Get secure today,
quickly and for free.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.

No credit card required | Scan results in 32 seconds.

Trusted by 150k+ orgs
  • Revolut
  • n8n
  • Lovable
  • Deel
  • Prove
  • Omnea