CVE-2026-18540

Name of the Vulnerable Software and Affected Versions undici versions prior to 6.28.1 undici versions 7.0.0 through 7.29.1 undici versions 8.0.0 through 8.10.2

Description The retry interceptor can append the body of a ranged retry response to bytes already delivered from a previous partial response while maintaining the original response status and headers. This occurs when an upstream server provides part of a body without a trustworthy resume checkpoint—such as a non-success response with already sent headers or a partial-content response with an unusable content range—closes the connection, and then provides more bytes in the resumed range request. Consequently, the response body may exceed the Content-Length observed by the application. If an application relays this response to a downstream HTTP/1.1 peer without normalizing the framing, the excess bytes may be interpreted as the start of a subsequent response, leading to downstream response splitting or desynchronization. This requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path.

Recommendations Update to version 6.28.1 for versions prior to 6.28.1. Update to version 7.29.1 for versions 7.0.0 through 7.29.1. Update to version 8.10.2 for versions 8.0.0 through 8.10.2.