undici CVE-2026-84947

Three conditions must align: (1) the application explicitly uses undici's dump interceptor feature - this is not enabled by default and requires developer opt-in; (2) the responding server sends a response using chunked transfer encoding without a Content-Length header; (3) the response body exceeds the interceptor's configured maximum byte threshold. Exploitation is further constrained by AC:H because the attacker must control or influence the responding HTTP server to return a qualifying chunked response of sufficient size. Standard Content-Length responses are handled safely and are not vulnerable. No authentication is required on the client side (PR:N), but server-side conditions must be met. Applications that never use the dump interceptor, or that only receive responses from trusted servers that always include Content-Length, are not exposed.

The CVSS 3.7 base score (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a low-severity, high-complexity issue. AC:H is justified because exploitation requires the application to have the dump interceptor enabled, the responding server to use chunked transfer encoding without a Content-Length header, and the body to exceed the configured maximum - three conditions that must align simultaneously. No EPSS data was provided, and the issue is not listed in CISA KEV. The vendor's A:N metric warrants scrutiny: connection teardown is an availability event, and in connection-pool-intensive applications the disconnection could exhaust pool slots or cause cascading request failures, suggesting A:L is arguably more accurate. The integrity impact (I:L) is realistic - application logic that interprets an empty body as a valid empty response may silently skip expected processing. Despite being reported by the OpenJS Foundation CNA under a GHSA advisory, no proof-of-concept code has been identified. Real-world risk is low unless the dump interceptor is actively used and the application handles large chunked responses from potentially adversarial servers.

A server returns a large chunked HTTP response (no Content-Length header) to a Node.js application using undici with the dump interceptor configured. Once the accumulated chunk bytes exceed the interceptor's maximum, the early completion signal is emitted; the parser delivers more bytes, fires a second completion event, and the assertion trips. The application's code receives an HTTP 200 with an empty body and continues as if the operation succeeded, while the underlying connection is silently destroyed.