CVE-2026-84947

What it actually does

undici's dump interceptor reads and discards HTTP response bodies up to a configured size cap. For chunked responses that omit Content-Length and exceed that cap, it signals completion early without pausing or aborting the stream. The parser keeps delivering body bytes, a second completion fires, and an internal assertion aborts the request and tears down the connection. Callers then see a successful status with an empty or truncated body even though the socket is already gone, so HTTP response integrity is not trustworthy. Confidentiality is unaffected; availability is not scored, despite the connection teardown.

Why it matters to the business

Applications that dump HTTP bodies with undici—including Red Hat Node.js 24/26 and Grafana 12 streams—can treat a failed or cut-off fetch as success and continue with missing data, causing wrong application state or skipped error handling. The flaw is not in CISA KEV, is not tied to ransomware, and has no known exploit maturity, so mass exploitation is unlikely 30 days after publication. Patch still matters wherever dump is used against untrusted or unbounded chunked responses. Red Hat addresses the shipped packages in RHSA-2026:54389.

How an attack unfolds

An attacker who can influence a response consumed by a vulnerable undici client (a malicious or compromised origin the app dumps, or any request the client can be induced to make) returns a chunked body with no Content-Length that exceeds the dump size limit. The interceptor marks the request complete too early; leftover body data causes a second completion and an assertion that disconnects the socket. The application proceeds as if the call succeeded with little or no body, which can desynchronize client logic. Attack complexity is high: dump-interceptor use, chunked encoding, a missing Content-Length, and a body over the cap must all coincide. No named threat actors or ransomware campaigns are reported, and public exploit maturity is none.

How to fix it

Upgrade undici to 7.29.1 on the 7.x line or 8.10.2 on the 8.x line (or later). On Red Hat, apply RHSA-2026:54389: grafana12-4-main 12.4.10-0.2.hum1, nodejs24-main 11.16.0-1.24.18.1.0.2.2.hum1, and nodejs26-main 26.7.0-1.5.2.hum1. Rebuild and redeploy images and apps that vendor undici so the patched library is what actually loads. Until then, do not use the dump interceptor against untrusted or unbounded chunked responses, and prefer origins that send Content-Length. There is no complete configuration-only fix in the vulnerable releases.

How to confirm the fix worked

Confirm running undici is 7.29.1, 8.10.2, or newer via lockfiles, SBOM, or npm ls undici. On Red Hat, verify installed NVRs meet or exceed the RHSA-2026:54389 versions above. Inventory Node.js and Grafana deployments for bundled undici in 7.1.0 through pre-7.29.1 and 8.0.0 through pre-8.10.2. After upgrade, exercise normal dump-interceptor traffic against large chunked responses from trusted test endpoints and confirm completion without assertion aborts, unexpected disconnects, or empty bodies on success. Do not use production or untrusted servers as a validation target.

Typical attack path

1. Attacker obtains the ability to supply or influence an HTTP response consumed by a client that uses undici's dump interceptor.
2. The client dumps a chunked response with no Content-Length whose body exceeds the configured dump maximum.
3. The interceptor emits an early completion while the parser continues, hitting an internal assertion and tearing down the connection.
4. The application records a successful status with an empty or truncated body.
5. Downstream logic proceeds on incomplete data, producing an integrity failure.

How to detect it

This defect shows up as an internal assertion and a torn-down client connection, not as malware or a stable network signature. Search Node.js stderr, process managers, container logs, and APM for assertion failures or sudden socket closes around HTTP clients that dump response bodies. Application logs that record 2xx results with empty or truncated bodies for requests expected to carry substantial content—especially chunked responses from untrusted hosts—are the main historical signal. Correlate with outbound HTTP activity from Grafana and Node.js services. No threat actors are associated and exploit maturity is none, so widespread past exploitation is unlikely; lack of these artifacts does not prove non-use, but their presence near dump-interceptor traffic warrants review.

What your security team should do

• Inventory Node.js, Grafana, and any app bundling undici 7.x or 8.x; this is not KEV and exploit maturity is none, so patch with other moderate library updates unless dump-against-untrusted-origins is confirmed.
• Apply RHSA-2026:54389 and upgrade undici to 7.29.1 or 8.10.2 (or later) in lockfiles, images, and OS packages, then redeploy.
• Find dump-interceptor call sites and review whether success is trusted when the body was discarded.
• Watch Node.js assertion failures and abrupt HTTP client disconnects until the fleet is patched.
• Add post-upgrade regression coverage that dumps oversized chunked responses from a controlled test fixture and asserts clean completion.