Response Body Handling Vulnerability in Undici by Node.js

CVE-2026-84947

What is CVE-2026-84947?

The vulnerability in Undici affects how response bodies are handled, especially with chunked responses lacking a Content-Length. The interceptor may trigger an early completion signal when the accumulated body size surpasses a set threshold, leading to misleading application behavior. Users might encounter an empty or truncated response even when the status indicates success, while the actual connection has been severed. This situation arises from internal assertion failures due to continuous byte delivery despite a broken connection signal. Users are advised to upgrade to appropriate patched versions.

References