EUVD-2026-71517Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H for three-condition alignment; A:L added because connection teardown is a concrete availability impact omitted by vendor's A:N.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
AnalysisAI
Chunked-body handling in undici's dump interceptor triggers a double-completion assertion that tears down the underlying TCP connection while returning a misleading success status to the application. Affected are undici versions 7.1.0 through 7.29.0 and 8.0.0 through 8.10.1; fixed releases 7.29.1 and 8.10.2 are available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must align: (1) the application explicitly uses undici's dump interceptor feature - this is not enabled by default and requires developer opt-in; (2) the responding server sends a response using chunked transfer encoding without a Content-Length header; (3) the response body exceeds the interceptor's configured maximum byte threshold. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.7 base score (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a low-severity, high-complexity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade undici to version 7.29.1 (for the 7.x branch) or 8.10.2 (for the 8.x branch); these are the vendor-confirmed fixed releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - includ
Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today