CVE-2026-84947 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

CVE-2026-84947

CVE-2026-84947 affects undici (Node.js HTTP client), specifically its dump interceptor . When a chunked response (no Content-Length) exceeds the configurable maximum body size, the interceptor signals completion early without pausing or aborting the request. The underlying parser then delivers a ...

CVE-2026-72860

9router 's POST /api/provider-nodes/validate route is vulnerable to Server-Side Request Forgery (SSRF) due to a flaw in its assertPublicUrl guard (src/shared/utils/ssrfGuard.js). The IPv4-mapped IPv6 denylist regex is unreachable because the WHATWG URL parser canonicalizes such literals to hextet...

undici: Undici: Response truncation and connection termination

A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection...

CVE-2026-46155 smb/client: fix out-of-bounds read in smb2_compound_op()

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2compoundop If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, checkwsleas returns success without validating that the entire...

DEBIAN-CVE-2025-32743

In ConnMan through 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or possibly execute arbitrary code, because those lookup values lead to...

CVE-2025-1861 Stream HTTP wrapper truncates redirect location to 1024 bytes

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC911...

Fedora 37 : httpd (2023-f6ff3f85eb)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f6ff3f85eb advisory. - new version 2.4.55 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Apache 2.4.x < 2.4.55 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.55. It is, therefore, affected by multiple vulnerabilities: - A crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header valu...

CVE-2022-37436

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client...