Disclosure summary
### Impact undici's `interceptors.dump()` reads and discards response bodies up to a configurable `maxSize`. When a response declares a `Content-Length` that exceeds `maxSize`, the request is aborted cleanly. When a response is sent chunked (no `Content-Length`) and its body exceeds `maxSize`, it is not aborted: the interceptor ends the response early once the accumulated size reaches `maxSize`, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading `200` with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected. ### Patches Upgrade to `7.29.1` or `8.10.2`. The dump interceptor now enforces `maxSize` on both the declared and the received body size, aborting the request with a `RequestAbortedError` instead of returning a truncated response. ### Workarounds None. Avoid using `interceptors.dump()` with untrusted upstreams until upgraded.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-2gqq-gqf2-x968
Open original source · Updated Sep 29, 2026
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
Source severity: LOW / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | undici | >= 7.1.0, < 7.29.1 | 7.29.1 |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-09-29T14:18:51-04:00
MODIFIED 2026-09-29T14:18:52-04:00
INGESTED 2026-10-06T11:43:08-04:00