undici is vulnerable to Improper Input Validation
37
Low Risk
The dump interceptor discards a response body up to maxSize. For a chunked response with no Content-Length, it signals completion once that size is reached instead of aborting, then a second completion from the parser tears down the connection. The application observes a successful status with an empty or truncated body. The fix enforces maxSize on both declared and received size and aborts instead of returning a truncated response.
You are affected if you are using a version that falls within the vulnerable range and you use interceptors.dump().
undici is vulnerable to Improper Input Validation in versions 7.1.0 - 7.29.0 and 8.0.0 - 8.10.1.
Upgrade the undici library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.