CVE-2026-16728Medium· 4.8▾ Sunlitundici vulnerable to downstream response desynchronization via retry interceptor
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.2%
Undici's interceptors.retry() can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry() and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale Content-Length header. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata.
A malicious or faulty upstream can respond to a range request with a 206 Partial Content response such as:
Content-Range: bytes 0-99/300
Content-Length: 300
and then send only 99 bytes before closing the socket. interceptors.retry() can then retry with Range: bytes=99-99, receive the final byte, and deliver a 100-byte body to the application while the response headers still contain Content-Length: 300 from the first response.
The bug requires interceptors.retry() to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculate Content-Length.
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
interceptors.retry() for untrusted upstreams.Content-Length before forwarding a response body assembled or transformed by Undici.undici < 6.28.0undici >= 7.0.0, < 7.29.0undici >= 8.0.0, < 8.9.0Upgrade to a patched release:
undici 6.28.0undici 7.29.0undici 8.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16729Medium· 4.8undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-14643Medium· 5.9undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
CVE-2026-15157Medium· 4.2undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-13697High· 7.4undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
CVE-2026-18540Low· 3.7undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers
CVE-2026-85008Low· 3.7undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is n…