CVE-2026-84947

Aliases:DEBIAN-CVE-2026-84947UBUNTU-CVE-2026-84947CGA-6jmg-q2c4-6hf4CGA-h756-wprr-7h7f
Advisory lineage Upstream: 0 Downstream: 2
Analyzed
Published: 04 Sept 2026, 16:53
Last modified:04 Sept 2026, 18:35

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (nvd)
EPSS Score
0.2% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Sept 2026, 16:53
Published
Vulnerability first disclosed
04 Sept 2026, 18:35
Last Modified
Vulnerability information updated

Description

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

CVSS Metrics

  • v3.1•LOW•Score: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Trends

Current EPSS score: 0.20%• Percentile: 10%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  • CWE-248•Uncaught Exception

    An exception is thrown from a function, but it is not caught.

Affected Systems

  • chainguard•node-gyp

    all | < 13.0.2-r1

  • wolfi•node-gyp

    all | < 13.0.2-r1

  • debian•node-undici

    all | all | all | < 8.10.2+dfsg+~cs3.2.2-1

  • ubuntu•node-undici

    all | all

  • nodejs•undici

    ≥ 7.1.0, < 7.29.1 | ≥ 8.0.0, < 8.10.2

  • undici•undici

    ≥ 7.1.0, < 7.29.1 | ≥ 8.0.0, < 8.10.2

References (5)