undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

[ Description ]Official description

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

[ Fixes ]Fixes and patches

• undici 7.29.1Fixed version · GitHub Advisories · npm package undici: upgrade to 7.29.1 or later (affected >= 7.1.0, < 7.29.1)
• undici 8.10.2Fixed version · GitHub Advisories · npm package undici: upgrade to 8.10.2 or later (affected >= 8.0.0, < 8.10.2)

[ Advisories ]Government CERT advisories

• CERT-FR16 Oct 2026CERTFR-2026-AVI-1336

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3596

  IBM App Connect Enterprise: Multiple vulnerabilities Translated from German

  CVE-2026-83610CVE-2026-13149CVE-2026-69152+49 more CVEs
• CERT-FR25 Sep 2026CERTFR-2026-AVI-1233

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

  CVE-2021-44906CVE-2026-59651CVE-2026-6402+183 more CVEs

[ Packages ]Affected open-source packages

• undici npmAffected >= 7.1.0, < 7.29.1 · fixed in 7.29.1 · GHSA-2gqq-gqf2-x968
• undici npmAffected >= 8.0.0, < 8.10.2 · fixed in 8.10.2 · GHSA-2gqq-gqf2-x968

[ References ]References

• github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968
• cna.openjsf.org/security-advisories.html