CVE-2026-84947
mediumPriorität · verfolgen · 21EPSS 0.002 · 9. PerzentilDEFRUSEPSS · bewertet 2026-10-22
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.7–5.3
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (9)
Betroffene Produkte und Versionsbereiche.
- IBM WebSphere Service Registry and Repositoryalle Versionencert_bundDEcpe:/a:ibm:websphere_service_registry_and_repository:-
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-3596IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-09-27csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.
- GHSA-2gqq-gqf2-x968undici vulnerable to response truncation via oversized chunked responses in the dump interceptor2026-09-29ghsa · osvUS
### Impact undici's `interceptors.dump()` reads and discards response bodies up to a configurable `maxSize`. When a response declares a `Content-Length` that exceeds `maxSize`, the request is aborted cleanly. When a response is sent chunked (no `Content-Length`) and its body exceeds `maxSize`, it is not aborted: the interceptor ends the response early once the accumulated size reaches `maxSize`, and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading `200` with an empty or truncated body while the connection is disconnected. Any application using the dump interceptor against untrusted or misbehaving upstreams is affected. ### Patches Upgrade to `7.29.1` or `8.10.2`. The dump interceptor now enforces `maxSize` on both the declared and the received body size, aborting the request with a `RequestAbortedError` instead of returning a truncated response. ### Workarounds None. Avoid using `interceptors.dump()` with untrusted upstreams until upgraded.
- CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
- CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (2) nvd
Externe Belege — Patches, Meldungen, Analysen.
- https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
- https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968Vendor Advisory
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan