CLEANSTART-2026-VZ88888: undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Q: How can I determine whether a deployment is affected?

The provided advisory data does not identify affected or fixed package versions, configuration conditions, or detection criteria. It only identifies the issue as affecting the npm package.

Q: What access or conditions does an attacker need to exploit this issue?

The provided data does not specify attacker access requirements, request conditions, or whether exploitation can occur remotely without authentication.

Q: Is a workaround available if patching cannot be performed immediately?

No workaround or compensating control is provided in the supplied advisory data.

Published Nov 7, 2026

Updated

Security vulnerability affects the npm package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers.

Affected Software

1 affected componentFixes available

cleanstart/npm<12.0.1-r1

12.0.1-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/npm to a version that resolves this vulnerability.
Fixed in 12.0.1-r1

Event History

Nov 7, 2026

Advisory Published

via OSV·12:35 AM

Data Sourced

via OSV·12:35 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18540

Frequently Asked Questions

How can I determine whether a deployment is affected?

The provided advisory data does not identify affected or fixed package versions, configuration conditions, or detection criteria. It only identifies the issue as affecting the npm package.

What access or conditions does an attacker need to exploit this issue?

The provided data does not specify attacker access requirements, request conditions, or whether exploitation can occur remotely without authentication.

Is a workaround available if patching cannot be performed immediately?

No workaround or compensating control is provided in the supplied advisory data.

CLEANSTART-2026-VZ88888: undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

How can I determine whether a deployment is affected?

What access or conditions does an attacker need to exploit this issue?

Is a workaround available if patching cannot be performed immediately?

Company

Resources

Contact

Frequently Asked Questions

How can I determine whether a deployment is affected?

What access or conditions does an attacker need to exploit this issue?

Is a workaround available if patching cannot be performed immediately?