Samuel871211

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 6.28.1 undici versions 7.0.0 through 7.29.1 undici versions 8.0.0 through 8.10.2 **Description** The retry interceptor can append the body of a ranged retry response to bytes already delivered from a previous partial response while maintaining the original response status and headers. This occurs when an upstream server provides part of a body without a trustworthy resume checkpoint—such as a non-success response with already sent headers or a partial-content response with an unusable content range—closes the connection, and then provides more bytes in the resumed range request. Consequently, the response body may exceed the `Content-Length` observed by the application. If an application relays this response to a downstream HTTP/1.1 peer without normalizing the framing, the excess bytes may be interpreted as the start of a subsequent response, leading to downstream response splitting or desynchronization. This requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. **Recommendations** Update to version 6.28.1 for versions prior to 6.28.1. Update to version 7.29.1 for versions 7.0.0 through 7.29.1. Update to version 8.10.2 for versions 8.0.0 through 8.10.2.

**Name of the Vulnerable Software and Affected Versions** undici versions prior to 6.28.0 undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x **Description** The retry interceptor can deliver a response where the body length does not match the `Content-Length` header after a retry or resume of a partial response. A malicious or faulty upstream server can return a partial response with a mismatched framing header and close the socket early, causing the retry interceptor to assemble a body of a different length while retaining the original `Content-Length`. This can lead to downstream response desynchronization, connection hangs, or response corruption in applications that forward upstream headers and bodies, such as proxies or gateways. Exploitation requires the retry interceptor to be enabled and a downstream forwarder that fails to remove or recalculate the `Content-Length` header. **Recommendations** Update to version 6.28.0 Update to version 7.29.0 Update to version 8.9.0