CVE-2026-84947

A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection is unexpectedly closed. This issue can lead to applications processing partial data or encountering unexpected connection disruptions.

Moderate impact: A flaw in the undici library's dump interceptor can cause applications to terminate connections and receive truncated data when processing oversized chunked HTTP responses without a Content-Length header. This can lead to application instability and incomplete data handling in Red Hat products that utilize the undici library and are exposed to untrusted HTTP upstreams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.