Undici's dump interceptor is designed to read a response body up to a configurable maximum. The vulnerability arises when a response lacks a Content-Length and uses chunked encoding. If the accumulated size reaches the maximum, the interceptor signals completion prematurely without pausing or aborting the request. Because the underlying network parser continues delivering data, a second completion event is generated, which triggers an internal assertion and forces the request to abort, tearing down the connection. The application therefore sees a successful status code but receives an empty or truncated body, while the network connection is unexpectedly closed. This flaw is a case of input validation and truncation (CWE‑20 and CWE‑248).

The issue affects the undici HTTP client in Node.js. Vulnerable versions include 7.1.0 through 7.29.1 and 8.0.0 through 8.10.2. Users of undici within their applications should upgrade to either 7.29.1 or 8.10.2 to eliminate the problem.

The CVSS score of 3.7 reflects a low severity impact. The likely attack vector is an untrusted upstream server or HTTP client that sends oversized chunked responses, which can cause the client to misinterpret the response, leading to data loss or denial of service through repeated requests. This inference comes from the description, as the flaw relies on manipulating the response format. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating a low to moderate exploitation probability. Because the client misinterprets responses, monitoring for anomalous aborted connections and ensuring proper validation of response bodies remain critical.