CVE-2026-16728

Name of the Vulnerable Software and Affected Versions undici versions prior to 6.28.0 undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x

Description The retry interceptor can deliver a response where the body length does not match the Content-Length header after a retry or resume of a partial response. A malicious or faulty upstream server can return a partial response with a mismatched framing header and close the socket early, causing the retry interceptor to assemble a body of a different length while retaining the original Content-Length. This can lead to downstream response desynchronization, connection hangs, or response corruption in applications that forward upstream headers and bodies, such as proxies or gateways. Exploitation requires the retry interceptor to be enabled and a downstream forwarder that fails to remove or recalculate the Content-Length header.

Recommendations Update to version 6.28.0 Update to version 7.29.0 Update to version 8.9.0