# CVE-2026-84947: undici response truncation via oversized chunked responses in dump interceptor

Source: https://junglewise.ai/threats/cve-2026-84947-undici-response-truncation-via-oversized-chunked-responses-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84947 · Severity: low · CVSS 3.7 · Published 2026-09-04

undici is a popular Node.js HTTP client library used by many applications to fetch data from remote servers. The dump interceptor—a tool for capturing and discarding response bodies up to a specified size limit—fails to properly handle responses sent without a declared size when they exceed the limit. This causes the application to report a successful response with truncated or empty data while silently disconnecting from the server, potentially causing data loss and connection reliability issues.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-84947 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84947 being exploited in the wild.

**How severe is CVE-2026-84947?** Low severity, with a CVSS score of 3.7, published 4 September 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=7.1.0,fixed=7.29.1.

**Is there a fix for CVE-2026-84947?** Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84947 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84947?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 7.29.1 or later

  ```sh
  npm install undici@7.29.1
  ```


## Technical details

The vulnerability is an input validation and improper exception handling issue (CWE-20, CWE-248) in undici's dump interceptor. When a chunked response (no Content-Length header) exceeds maxSize, the interceptor signals early completion but the underlying HTTP parser continues delivering body bytes, triggering a second completion signal that violates an internal assertion. This causes the connection to be torn down and the application to observe a misleading 200 status code with truncated content. The attack requires network reachability to a misbehaving or untrusted upstream server; no authentication or user interaction is required. Affected versions are 7.1.0–7.29.0 and 8.0.0–8.10.1; patches are available in 7.29.1 and 8.10.2.

## Affected products

- OpenJS Foundation undici 7.1.0 to 7.29.0, 8.0.0 to 8.10.1

## Identifiers

- CVE-2026-84947
- GHSA-2gqq-gqf2-x968

## Timeline

- 2026-09-04: disclosed: CVE-2026-84947 and GHSA-2gqq-gqf2-x968 published
- 2026-09-04: patched: Patches released in undici 7.29.1 and 8.10.2

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968](https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)