@nxtedition/nxt-undici 7.4.1 → 7.4.3

package/lib/interceptor/dns.js

@@ -44,6 +44,27 @@ class Handler extends DecoratorHandler {
 
 const SWEEP_INTERVAL = 30e3
 
+// A cached (or in-flight-shared) lookup error must never be handed to more
+// than one caller as-is: downstream decorateError call sites (response-retry,
+// response-error) mutate the error they receive (err.req, err.res,
+// err.statusCode), so a shared object would leak one request's decoration
+// into another's. Give each caller a fresh Error carrying the identifying
+// dns fields, with the original attached as `cause`.
+function makeLookupError(err) {
+  const wrapped = new Error(err.message, { cause: err })
+  wrapped.code = err.code
+  if (err.errno !== undefined) {
+    wrapped.errno = err.errno
+  }
+  if (err.syscall !== undefined) {
+    wrapped.syscall = err.syscall
+  }
+  if (err.hostname !== undefined) {
+    wrapped.hostname = err.hostname
+  }
+  return wrapped
+}
+
 // Error codes that mean the IP itself is unreachable/bad, so the selected
 // record should be invalidated immediately (expires = 0), forcing a re-resolve.
 // Anything else surfaced on the response path — a headers/body timeout, a
@@ -67,12 +88,16 @@ const CONNECTION_ERROR_CODES = new Set([
 
 export default () => (dispatch) => {
   const cache = new Map()
+  const negatives = new Map()
   const promises = new Map()
 
   // The `cache` Map is otherwise only ever written, never trimmed, so a process
   // touching many distinct hostnames over its lifetime would leak entries that
   // can never be selected again. Sweep dead entries (all records expired and
   // none in flight) at most once per SWEEP_INTERVAL to bound the O(n) cost.
+  // Negative entries are swept on the same cadence (they are also deleted
+  // eagerly on the next successful lookup / overwritten on the next failure,
+  // so the sweep only matters for hostnames that are never touched again).
   let lastSweep = 0
   function sweep(now) {
     if (now - lastSweep < SWEEP_INTERVAL) {
@@ -84,18 +109,33 @@ export default () => (dispatch) => {
         cache.delete(hostname)
       }
     }
+    for (const [hostname, negative] of negatives) {
+      if (negative.expires < now) {
+        negatives.delete(hostname)
+      }
+    }
   }
 
-  function resolve(hostname, { ttl }) {
+  function resolve(hostname, { ttl, negativeTTL, lookup }) {
     let promise = promises.get(hostname)
     if (!promise) {
       promise = new Promise((resolve) => {
-        dns.lookup(hostname, { all: true }, (err, records) => {
+        lookup(hostname, { all: true }, (err, records) => {
           promises.delete(hostname)
 
           if (err) {
+            // Negative cache: remember the failure for a short while so a hot
+            // caller of an unresolvable host fails fast instead of issuing a
+            // lookup storm (response-retry retries ENOTFOUND/EAI_AGAIN up to
+            // `retry` (default 8) times, so without this every logical
+            // request produced ~9 lookups). EAI_AGAIN is transient by
+            // definition, but the same small TTL applies — the window only
+            // needs to absorb a retry burst, and a short TTL keeps recovery
+            // fast either way.
+            negatives.set(hostname, { err, expires: getFastNow() + negativeTTL })
             resolve([err, null])
           } else {
+            negatives.delete(hostname)
             const now = getFastNow()
             const val = records.map(({ address }) => {
               return {
@@ -125,6 +165,8 @@ export default () => (dispatch) => {
       }
 
       const ttl = opts.dns.ttl ?? 2e3
+      const negativeTTL = opts.dns.negativeTTL ?? 1e3
+      const lookup = opts.dns.lookup ?? dns.lookup
       const url = new URL(opts.path ?? '', opts.origin)
       const balance = opts.dns.balance
 
@@ -141,9 +183,19 @@ export default () => (dispatch) => {
       let records = cache.get(hostname)
 
       if (records == null || records.every((x) => x.expires < now)) {
-        const [err, val] = await resolve(hostname, { ttl })
+        // A fresh negative entry means a lookup for this hostname failed less
+        // than negativeTTL ago — fail fast instead of hitting the resolver
+        // again. Fresh positive records (checked above) take precedence, so a
+        // failed pre-emptive refresh never fails requests that can still be
+        // served from cache.
+        const negative = negatives.get(hostname)
+        if (negative != null && negative.expires >= now) {
+          throw makeLookupError(negative.err)
+        }
+
+        const [err, val] = await resolve(hostname, { ttl, negativeTTL, lookup })
         if (err) {
-          throw err
+          throw makeLookupError(err)
         }
         records = val
       }
@@ -190,7 +242,7 @@ export default () => (dispatch) => {
       // refreshed records land in cache for the next request, smoothing
       // out DNS lookup latency. `resolve()` dedupes via `promises`.
       if (records.some((x) => x.expires < now + ttl / 2)) {
-        resolve(hostname, { ttl })
+        resolve(hostname, { ttl, negativeTTL, lookup })
       }
 
       url.hostname = net.isIPv6(record.address) ? `[${record.address}]` : record.address
@@ -224,8 +276,23 @@ export default () => (dispatch) => {
       }
 
       try {
+        // origin is rewritten to the resolved IP, so pin the host header to
+        // the logical hostname — but never clobber an explicit user-supplied
+        // host (virtual hosting). Lowercase lookup matches the pipeline
+        // invariant (parseHeaders) and priority.js, which reads the same key.
+        // Host is a singular header, so only a single non-empty string value
+        // is preserved (same rule as priority.js) — an array (duplicate Host
+        // field-lines) or an empty string falls back to the origin-derived
+        // host.
         return dispatch(
-          { ...opts, origin: url.origin, headers: { ...opts.headers, host } },
+          {
+            ...opts,
+            origin: url.origin,
+            headers: {
+              ...opts.headers,
+              host: (typeof opts.headers?.host === 'string' && opts.headers.host) || host,
+            },
+          },
           new Handler(handler, onSettle),
         )
       } catch (err) {

package/lib/interceptor/log.js

@@ -1,10 +1,144 @@
-import { DecoratorHandler } from '../utils.js'
+import { DecoratorHandler, parseHeaders } from '../utils.js'
 
 const kGlobalIndex = Symbol.for('@nxtedition/nxt-undici#globalIndex')
 const kGlobalArray = Symbol.for('@nxtedition/nxt-undici#globalArray')
 
+const REDACTED = '[redacted]'
+
+// Header names (lowercase) whose values must never reach the logs.
+const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie'])
+
+// Allocation-free pre-scan: true when `headers` is a plain object that the
+// parse + redact path would reproduce verbatim — every key already lowercase,
+// every value a string (or array of strings), no secret header present. In
+// that case the original object can be logged as-is: log bindings only read
+// it (pino serializes child bindings eagerly), nothing in the pipeline
+// mutates a caller's headers object in place. Uses a `for..in` + `Object.hasOwn`
+// guard rather than `Object.keys` so the scan itself allocates nothing while
+// still ignoring inherited props exactly as `Object.keys` would.
+function isCleanHeaderObject(headers) {
+  for (const key in headers) {
+    if (!Object.hasOwn(headers, key)) {
+      continue
+    }
+    if (SECRET_HEADERS.has(key) || key.toLowerCase() !== key) {
+      return false
+    }
+    const val = headers[key]
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (typeof item !== 'string') {
+          return false
+        }
+      }
+    } else if (typeof val !== 'string') {
+      return false
+    }
+  }
+  return true
+}
+
+// Return a loggable view of `headers` with credential values replaced by a
+// redaction marker. Copy-on-write: the common case (already-lowercased plain
+// object, string values, nothing to redact) returns the original object as-is,
+// allocating no new headers object (the pre-scan itself is allocation-free
+// too). Only when something actually needs work — flat-array
+// form ([name, value, name, value, ...] with Buffer or string entries from
+// onHeaders/onUpgrade), a secret header, a non-lowercase name, or a
+// non-string value — do we build a sanitized copy via parseHeaders, which
+// lowercases names, stringifies values (Buffers included, so no
+// `{type:'Buffer',data:[...]}` blobs in bindings), skips null/undefined, and
+// merges duplicate names into arrays instead of overwriting earlier values.
+function sanitizeHeaders(headers) {
+  if (headers == null || typeof headers !== 'object') {
+    return undefined
+  }
+
+  if (!Array.isArray(headers) && isCleanHeaderObject(headers)) {
+    return headers
+  }
+
+  const sanitized = parseHeaders(headers)
+
+  for (const name of SECRET_HEADERS) {
+    if (name in sanitized) {
+      sanitized[name] = REDACTED
+    }
+  }
+
+  return sanitized
+}
+
+// Normalize the request origin for logging without leaking userinfo
+// credentials embedded as `http://user:pass@host`. Copy-on-write: userinfo
+// requires an '@', so a string without one is returned as-is — no URL
+// allocation. Real `URL` instances already expose a credential-free
+// `origin`; arbitrary URL-like objects do NOT get that fast path, since a
+// plain `{ origin: 'http://user:pass@host' }` would bypass the userinfo
+// check. Everything else is stringified, and only strings that could carry
+// userinfo are parsed and reduced to URL#origin (which never contains
+// userinfo); if such a string is not a parseable URL, prefer losing the
+// value over risking embedded credentials.
+function sanitizeOrigin(origin) {
+  if (origin == null) {
+    return undefined
+  }
+  if (origin instanceof URL) {
+    return origin.origin
+  }
+  const str = typeof origin === 'string' ? origin : String(origin)
+  if (!str.includes('@')) {
+    return str
+  }
+  try {
+    return new URL(str).origin
+  } catch {
+    return REDACTED
+  }
+}
+
+// Summarize the request body (type + size) instead of embedding its content.
+// Bodies may contain credentials or be arbitrarily large, and pino serializes
+// child bindings eagerly — never put the payload itself into the log record.
+function describeBody(body) {
+  if (body == null) {
+    return undefined
+  }
+  if (typeof body === 'string') {
+    return `string(${Buffer.byteLength(body)} bytes)`
+  }
+  if (Buffer.isBuffer(body)) {
+    return `Buffer(${body.byteLength} bytes)`
+  }
+  if (ArrayBuffer.isView(body)) {
+    return `${body.constructor?.name ?? 'TypedArray'}(${body.byteLength} bytes)`
+  }
+  if (typeof body === 'object' && typeof body.byteLength === 'number') {
+    return `${body.constructor?.name ?? 'ArrayBuffer'}(${body.byteLength} bytes)`
+  }
+  if (typeof body === 'function') {
+    return 'function'
+  }
+  return body.constructor?.name ?? typeof body
+}
+
+// Small, sanitized summary of the request opts used for all `ureq` log
+// bindings. Built once per request instead of binding the live opts object,
+// which both leaked credentials/bodies into logs and paid eager pino
+// serialization of the full opts (including the entire body) per request.
+function sanitizeRequest(opts) {
+  return {
+    id: opts.id,
+    origin: sanitizeOrigin(opts.origin),
+    path: opts.path,
+    method: opts.method,
+    headers: sanitizeHeaders(opts.headers),
+    body: describeBody(opts.body),
+  }
+}
+
 class Handler extends DecoratorHandler {
-  #opts
+  #ureq
   #logger
 
   #abort
@@ -25,8 +159,8 @@ class Handler extends DecoratorHandler {
   constructor(logOpts, opts, { handler }) {
     super(handler)
 
-    this.#opts = opts
-    this.#logger = opts.logger.child({ ureq: opts })
+    this.#ureq = sanitizeRequest(opts)
+    this.#logger = opts.logger.child({ ureq: this.#ureq })
 
     if (logOpts?.bindings) {
       this.#logger = this.#logger.child(logOpts?.bindings)
@@ -59,7 +193,7 @@ class Handler extends DecoratorHandler {
 
     this.#logger.debug(
       {
-        ures: { statusCode, headers },
+        ures: { statusCode, headers: sanitizeHeaders(headers) },
         elapsedTime: this.#timing.headers,
       },
       'upstream request upgrade',
@@ -76,7 +210,9 @@ class Handler extends DecoratorHandler {
   onHeaders(statusCode, headers, resume) {
     this.#timing.headers = performance.now() - this.#created
     this.#statusCode = statusCode
-    this.#headers = headers
+    // Only used for log records; store the sanitized copy so set-cookie etc.
+    // never end up in retained (error-level) logs.
+    this.#headers = sanitizeHeaders(headers)
 
     return super.onHeaders(statusCode, headers, resume)
   }
@@ -95,7 +231,7 @@ class Handler extends DecoratorHandler {
     this.#timing.end = performance.now() - this.#created
 
     const data = {
-      ureq: this.#opts,
+      ureq: this.#ureq,
       ures: {
         statusCode: this.#statusCode,
         headers: this.#headers,
@@ -161,7 +297,46 @@ class Handler extends DecoratorHandler {
       this[kGlobalIndex] = -1
     }
   }
+
+  // Finalization for a request whose inner dispatch threw synchronously:
+  // undici never took ownership of the handler, so no terminal callback
+  // (onError/onComplete) will ever arrive. Log the failure and deregister
+  // from the in-flight registry. Deliberately does NOT forward onError —
+  // the dispatch entry below rethrows and an outer interceptor (lookup)
+  // delivers the error to the original handler chain, so forwarding here
+  // would double-deliver it.
+  onDispatchError(err) {
+    if (this[kGlobalIndex] === -1) {
+      // A terminal callback already ran before the error escaped dispatch
+      // (e.g. onError was delivered and the error was then rethrown):
+      // already logged and deregistered.
+      return
+    }
+
+    this.#timing.end = performance.now() - this.#created
+
+    this.#logger.error({ err, elapsedTime: this.#timing.end }, 'upstream request failed')
+
+    this.onDone()
+  }
 }
 
-export default (logOpts) => (dispatch) => (opts, handler) =>
-  opts.logger ? dispatch(opts, new Handler(logOpts, opts, { handler })) : dispatch(opts, handler)
+export default (logOpts) => (dispatch) => (opts, handler) => {
+  if (!opts.logger) {
+    return dispatch(opts, handler)
+  }
+
+  const logHandler = new Handler(logOpts, opts, { handler })
+
+  try {
+    return dispatch(opts, logHandler)
+  } catch (err) {
+    // An inner interceptor threw synchronously at dispatch time (e.g. proxy
+    // loop detection). The error escapes past the already-registered handler,
+    // which would otherwise stay in the global in-flight registry forever.
+    // Finalize it and rethrow so outer interceptors observe the same error
+    // as before.
+    logHandler.onDispatchError(err)
+    throw err
+  }
+}

package/lib/interceptor/pressure.js

@@ -326,6 +326,17 @@ class Handler extends DecoratorHandler {
     return super.onHeaders(statusCode, headers, resume)
   }
 
+  onUpgrade(statusCode, headers, socket) {
+    // A successful upgrade (HTTP 101) is its own terminal branch — neither
+    // onComplete nor onError follows it (see the dns interceptor's Handler for
+    // the same fix). Settle as a success here, otherwise `running` stays >= 1
+    // forever: the per-origin record can never satisfy the eviction condition
+    // and the sampling timer keeps firing for the process lifetime. An upgrade
+    // is a success, not an overload error.
+    this.#settle(false)
+    super.onUpgrade(statusCode, headers, socket)
+  }
+
   onComplete(trailers) {
     this.#settle(isErrorStatus(this.#statusCode))
     super.onComplete(trailers)

package/lib/interceptor/proxy.js

@@ -2,13 +2,15 @@ import net from 'node:net'
 import createError from 'http-errors'
 import { DecoratorHandler } from '../utils.js'
 
+function noop() {}
+
 // Accumulator used by reduceHeaders on the response path. Hoisted to module
 // scope so it is allocated once rather than on every onHeaders/onUpgrade call.
 /**
- * @param {Record<string, string>} acc
+ * @param {Record<string, string | string[]>} acc
  * @param {string} key
- * @param {string} val
- * @returns {Record<string, string>}
+ * @param {string | string[]} val
+ * @returns {Record<string, string | string[]>}
  */
 const copyHeader = (acc, key, val) => {
   acc[key] = val
@@ -25,9 +27,9 @@ class Handler extends DecoratorHandler {
   }
 
   onUpgrade(statusCode, headers, socket) {
-    super.onUpgrade(
-      statusCode,
-      reduceHeaders(
+    let reduced
+    try {
+      reduced = reduceHeaders(
         {
           headers,
           httpVersion: this.#opts.httpVersion ?? this.#opts.req?.httpVersion,
@@ -39,9 +41,21 @@ class Handler extends DecoratorHandler {
         },
         copyHeader,
         {},
-      ),
-      socket,
-    )
+      )
+    } catch (err) {
+      // reduceHeaders throws on protocol errors (inbound Forwarded on a
+      // response → BadGateway, looping Via → LoopDetected). A throw must not
+      // escape onUpgrade: undici's H1 upgrade path nulls the request's queue
+      // slot before invoking onUpgrade and its catch only destroys the socket
+      // — no onError ever reaches the handler chain, leaving the caller
+      // waiting forever. Deliver the terminal error downstream ourselves
+      // (super.onError is once-guarded) and destroy the socket so it is not
+      // leaked; noop error listener since nothing downstream ever receives it.
+      socket.on('error', noop).destroy(err)
+      super.onError(err)
+      return
+    }
+    super.onUpgrade(statusCode, reduced, socket)
   }
 
   onHeaders(statusCode, headers, resume) {
@@ -94,10 +108,13 @@ function eqiLower(a, b) {
 // allocation-free and letting the common (non-hop) header bail out in a single
 // comparison.
 /**
+ * Exported for reuse by the cache interceptor: RFC 9111 §3.1 forbids storing
+ * hop-by-hop fields, which is the same set a proxy must not retransmit.
+ *
  * @param {string} key
  * @returns {boolean}
  */
-function isHopByHop(key) {
+export function isHopByHop(key) {
   switch (key.length) {
     case 2:
       return eqiLower(key, 'te')
@@ -148,8 +165,10 @@ function isHopByHop(key) {
  * @param {boolean} [options.isResponse] Response path marker. When set,
  *   Forwarded is never synthesised regardless of `socket` (it would leak the
  *   proxy's own addresses downstream); an inbound Forwarded is still rejected.
- * @param {(acc: T, key: string, value: string) => T} fn Accumulator invoked
- *   once per retained header.
+ * @param {(acc: T, key: string, value: string | string[]) => T} fn Accumulator
+ *   invoked once per retained header. The value is an array when the field
+ *   appeared more than once (parseHeaders shape) — never pre-joined, because
+ *   fields like set-cookie (RFC 6265) must keep distinct field lines.
  * @param {T} acc Initial accumulator value.
  * @returns {T}
  */
@@ -262,7 +281,16 @@ function reduceHeaders({ headers, proxyName, httpVersion, socket, isResponse },
       (remove === null || !remove.includes(key.toLowerCase())) &&
       !isHopByHop(key)
     ) {
-      acc = fn(acc, key, headers[key].toString())
+      // A repeated field-line arrives as an array (parseHeaders collects
+      // them). Pass it through as-is — .toString() would comma-join with no
+      // space, corrupting fields whose values legally contain commas and must
+      // never be combined: set-cookie (RFC 9110 §5.3 / RFC 6265, e.g. an
+      // Expires date) and multi-challenge www-authenticate. Array values are
+      // exactly the shape parseHeaders delivers without this interceptor, and
+      // both the request path (undici accepts array header values) and the
+      // response handler chain already relay it.
+      const value = headers[key]
+      acc = fn(acc, key, Array.isArray(value) ? value : value.toString())
     }
   }
 
@@ -358,7 +386,10 @@ export default () => (dispatch) => (opts, handler) => {
       proxyName: opts.proxy.name,
     },
     (obj, key, val) => {
-      if (key === 'content-length' && !expectsPayload) {
+      // Case-insensitive (eqiLower) like reduceHeaders' capture above: the
+      // standalone interceptors.proxy() composition may pass mixed-case keys
+      // (the production path lowercases via parseHeaders first).
+      if (!expectsPayload && key.length === 14 && eqiLower(key, 'content-length')) {
         // https://tools.ietf.org/html/rfc7230#section-3.3.2
         // A user agent SHOULD NOT send a Content-Length header field when
         // the request message does not contain a payload body and the method
@@ -366,7 +397,7 @@ export default () => (dispatch) => (opts, handler) => {
         // undici will error if provided an unexpected content-length: 0 header.
       } else if (key[0] === ':') {
         // strip pseudo headers
-      } else if (key === 'expect') {
+      } else if (key.length === 6 && eqiLower(key, 'expect')) {
         // undici doesn't support expect header.
       } else {
         obj[key] = val

package/lib/interceptor/redirect.js

@@ -1,5 +1,5 @@
 import assert from 'node:assert'
-import { DecoratorHandler, isDisturbed, parseURL, parseHeaders } from '../utils.js'
+import { DecoratorHandler, isDisturbed, parseURL, parseHeaders, buildURL } from '../utils.js'
 
 const redirectableStatusCodes = [300, 301, 302, 303, 307, 308]
 
@@ -105,9 +105,15 @@ class Handler extends DecoratorHandler {
       }
     }
 
-    const { origin, pathname, search } = parseURL(
-      new URL(this.#location, this.#opts.origin && new URL(this.#opts.path, this.#opts.origin)),
-    )
+    // Build the base URL by concatenating origin + path via buildURL rather
+    // than `new URL(path, origin)`: the latter is unsafe when `path` is
+    // protocol-relative (e.g. `//evil-host/x`, reachable via a request URL like
+    // `https://good.com//evil-host/x`). WHATWG URL would then treat the path's
+    // leading host as the authority and discard the good origin, so a *relative*
+    // Location would resolve against the attacker-controlled host — an SSRF /
+    // request-misrouting pivot. See buildURL in ../utils.js.
+    const base = this.#opts.origin && buildURL(this.#opts.origin, this.#opts.path)
+    const { origin, pathname, search } = parseURL(new URL(this.#location, base))
     const path = search ? `${pathname}${search}` : pathname
 
     // Remove headers referring to the original URL.
@@ -118,7 +124,7 @@ class Handler extends DecoratorHandler {
       headers: cleanRequestHeaders(
         this.#opts.headers,
         statusCode === 303,
-        this.#opts.origin !== origin,
+        !isSameOrigin(this.#opts.origin, origin),
       ),
       path,
       origin,
@@ -191,6 +197,27 @@ class Handler extends DecoratorHandler {
   }
 }
 
+// `target` is always a WHATWG-normalized origin (it comes off a parsed URL:
+// lowercased host, default port elided, no path), while `optsOrigin` is
+// caller-provided and may not be (trailing slash, explicit `:80`/`:443`,
+// uppercase host — defaultLookup in index.js even produces `http://host:80`
+// for object-form origins). A raw string compare misclassifies such
+// same-origin redirects as cross-origin and strips authorization/cookie,
+// breaking authenticated redirect flows with a confusing 401. Normalize
+// through `new URL` before comparing; if optsOrigin is not parseable, keep
+// the raw-compare result (already false here), which fails toward stripping —
+// the safe direction.
+function isSameOrigin(optsOrigin, target) {
+  if (optsOrigin === target) {
+    return true
+  }
+  try {
+    return new URL(optsOrigin).origin === target
+  } catch {
+    return false
+  }
+}
+
 // https://tools.ietf.org/html/rfc7231#section-6.4.4
 function shouldRemoveHeader(header, removeContent, unknownOrigin) {
   return (
@@ -199,6 +226,9 @@ function shouldRemoveHeader(header, removeContent, unknownOrigin) {
     (unknownOrigin &&
       header.length === 13 &&
       header.toString().toLowerCase() === 'authorization') ||
+    (unknownOrigin &&
+      header.length === 19 &&
+      header.toString().toLowerCase() === 'proxy-authorization') ||
     (unknownOrigin && header.length === 6 && header.toString().toLowerCase() === 'cookie')
   )
 }

package/lib/interceptor/request-body-factory.js

@@ -1,5 +1,5 @@
 import { Readable, finished } from 'node:stream'
-import { isStream } from '../utils.js'
+import { DecoratorHandler, isStream } from '../utils.js'
 
 function noop() {}
 
@@ -15,11 +15,26 @@ class FactoryStream extends Readable {
 
   _construct(callback) {
     this.#ac = new AbortController()
+    // Note: #ac is intentionally kept after the factory settles, so that a
+    // destroy with an error can still abort the factory's signal (see
+    // _destroy) — e.g. the request failing before undici started writing
+    // the body.
     Promise.resolve(this.#factory({ signal: this.#ac.signal })).then(
       (body) => {
-        this.#ac = null
         try {
-          if (typeof body === 'string' || body instanceof Buffer) {
+          // Normalize binary bodies to Buffer (zero-copy: reinterpret the same
+          // memory). Without this a TypedArray/DataView falls through to
+          // Readable.from(), which iterates e.g. a Uint8Array element-wise and
+          // push(number) then throws an uncaught ERR_INVALID_ARG_TYPE inside
+          // the 'data' emit. Mirrors utils.js isBuffer() treating Uint8Array
+          // as a buffer, extended to all ArrayBuffer views.
+          if (ArrayBuffer.isView(body) && !Buffer.isBuffer(body)) {
+            body = Buffer.from(body.buffer, body.byteOffset, body.byteLength)
+          } else if (body instanceof ArrayBuffer) {
+            body = Buffer.from(body)
+          }
+
+          if (typeof body === 'string' || Buffer.isBuffer(body)) {
             this.push(body)
             this.push(null)
           } else if (isStream(body)) {
@@ -67,7 +82,13 @@ class FactoryStream extends Readable {
 
   _destroy(err, callback) {
     if (this.#ac) {
-      this.#ac.abort(err)
+      // Abort the factory's signal on any error, and on a premature destroy
+      // (destroyed before 'end'), so the factory can cancel whatever it is
+      // producing. A clean destroy after a fully consumed body (autoDestroy
+      // after 'end') must not abort — the factory finished normally.
+      if (err || !this.readableEnded) {
+        this.#ac.abort(err)
+      }
       this.#ac = null
     }
 
@@ -80,7 +101,37 @@ class FactoryStream extends Readable {
   }
 }
 
-export default () => (dispatch) => (opts, handler) =>
-  typeof opts.body !== 'function'
-    ? dispatch(opts, handler)
-    : dispatch({ ...opts, body: new FactoryStream(opts.body).on('error', noop) }, handler)
+class Handler extends DecoratorHandler {
+  #body
+
+  constructor(handler, body) {
+    super(handler)
+    this.#body = body
+  }
+
+  onError(err) {
+    // Undici only destroys a request body once it has started writing it. If
+    // the dispatch fails before that (connect error/timeout, DNS failure,
+    // abort while queued, sync throw from an inner interceptor), nobody else
+    // owns the FactoryStream — but the factory has already run on nextTick
+    // (side effects, e.g. an open fd from fs.createReadStream), so destroy it
+    // here. destroy() is idempotent: if undici already consumed or destroyed
+    // the stream this is a no-op.
+    this.#body.destroy(err)
+    super.onError(err)
+  }
+}
+
+export default () => (dispatch) => (opts, handler) => {
+  if (typeof opts.body !== 'function') {
+    return dispatch(opts, handler)
+  }
+
+  const body = new FactoryStream(opts.body).on('error', noop)
+  try {
+    return dispatch({ ...opts, body }, new Handler(handler, body))
+  } catch (err) {
+    body.destroy(err)
+    throw err
+  }
+}