CVE-2026-18540: undici vulnerable to downstream response splitting via retry interceptor
Impact
Undici's interceptors.retry() can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded Content-Length, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).
For example, a 404 Not Found with Content-Length: 2 that sends one byte then closes can be resumed with an open-ended Range request, and the resumed 206 Partial Content bytes are appended, so the application receives more than two body bytes while still seeing Content-Length: 2. The bug requires interceptors.retry() enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate Content-Length.
Patches
Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.
Workarounds
- Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0. - Remove or recalculate Content-Length before forwarding a response body assembled by Undici.
Other sources
undici vulnerable to downstream response splitting via retry interceptor
— Microsoft
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.10.2 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.29.1 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.28.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.28.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.29.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.10.2 - Configuration
Disable interceptors.retry() for untrusted upstreams, or set maxRetries to 0.
undici interceptors.retry() maxRetries = 0 - Compensating control
Remove or recalculate Content-Length before forwarding a response body assembled by Undici.
Event History
Frequently Asked Questions
Which deployments are exposed to downstream response splitting?
Exposure requires both an attacker-controlled upstream server and an application that relays the upstream response to a downstream HTTP/1.1 peer through a framing-sensitive path. Applications that do not forward such responses through that path are not described as exploitable.
What conditions must an attacker create upstream?
The upstream server must deliver a partial body without a trustworthy resume checkpoint, close the connection, and return additional bytes to the resumed range request. Examples include a non-success response after headers have been sent, or a partial-content response with an unusable Content-Range.
How can I determine whether my undici version is affected?
Affected versions are releases before 6.28.1, versions from 7.0.0 through 7.29.1, and versions from 8.0.0 through 8.10.2. Check the installed undici version against those ranges.
What can be done if an immediate upgrade is not possible?
Avoid relaying affected upstream responses through framing-sensitive HTTP/1.1 paths unless response framing is normalized. The issue arises when more body bytes are forwarded than the Content-Length observed by the application.