Skip to content

fix: reject FormData bodies that were not created by undici - #5894

Closed
v1teka wants to merge 1 commit into
nodejs:mainfrom
v1teka:fix/request-foreign-formdata
Closed

v1teka wants to merge 1 commit into
nodejs:mainfrom
v1teka:fix/request-foreign-formdata

Conversation

@v1teka

@v1teka v1teka commented Sep 24, 2026

Copy link
Copy Markdown

This relates to...

Fixes #5520

Rationale

request() with Node's global FormData (or any FormData that isn't undici's own) hangs forever: nothing is written to the socket and no error is raised. The Request constructor accepts any FormData-like object, but extractBody() only serializes undici's own FormData, so a foreign one ends up as a body stream that never produces data.

#5521 took the "throw instead of encode" route that was agreed on there, but it was closed without being merged and #5520 is still open, so I picked it up with the same approach.

Changes

  • lib/core/request.js: a FormData-like body that fails the webidl.is.FormData brand check now throws InvalidArgumentError (the check is loaded lazily)
  • test/client-request.js: a duck-typed FormData and Node's global FormData both reject, and the server never receives a request. On main the test hangs until it times out.
  • docs/docs/api/Dispatcher.md: one sentence on which FormData body accepts

Features

N/A

Bug Fixes

  • request() / dispatch() with a FormData not created by undici rejects with InvalidArgumentError instead of hanging

Breaking Changes and Deprecations

N/A. These bodies never worked on v7/v8: 7.0–7.19 threw a TypeError, and 7.20+ hangs.

Status

A FormData from another source, such as Node.js' global FormData, passes
the duck-typed isFormDataLike() check in the Request constructor, but
extractBody() only serializes undici's own FormData. The request was
then dispatched with a body that never produces data and hung forever.

Throw an InvalidArgumentError for such bodies instead, as agreed in
nodejs#5521, and document it for dispatch().

Fixes: nodejs#5520
Signed-off-by: v1teka <29147256+v1teka@users.noreply.github.com>
@codecov-commenter

codecov-commenter commented Sep 24, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.98%. Comparing base (328ab84) to head (ea69d3c).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #5894   +/-   ##
=======================================
  Coverage   93.98%   93.98%           
=======================================
  Files         110      110           
  Lines       40044    40059   +15     
=======================================
+ Hits        37635    37650   +15     
  Misses       2409     2409           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@KhafraDev KhafraDev closed this Sep 25, 2026
@v1teka

v1teka commented Sep 26, 2026

Copy link
Copy Markdown
Author

Hi @KhafraDev, could you share why this was closed? If the approach, the test or the docs line should be different, I'm happy to rework it. #5520 is still open, so I'd like to know what would make a fix for it acceptable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

3 participants