Every CVE Search/ Get API key

CVE-2026-16728

undici vulnerable to downstream response desynchronization via retry interceptor

4.8 MediumFix available

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.29%Up 0.1 points since Jul 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

undici vulnerable to downstream response desynchronization via retry interceptor

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Record
CVE-2026-16728
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-50566 4.8

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Record
EUVD-2026-50566
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8xcm-r25x-g524 4.8

undici vulnerable to downstream response desynchronization via retry interceptor

Impact

Undici's interceptors.retry() can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry() and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale Content-Length header. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata.

A malicious or faulty upstream can respond to a range request with a 206 Partial Content response such as:

Content-Range: bytes 0-99/300
Content-Length: 300

and then send only 99 bytes before closing the socket. interceptors.retry() can then retry with Range: bytes=99-99, receive the final byte, and deliver a 100-byte body to the application while the response headers still contain Content-Length: 300 from the first response.

The bug requires interceptors.retry() to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculate Content-Length.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.

Workarounds

  • Disable interceptors.retry() for untrusted upstreams.
  • Remove or recalculate Content-Length before forwarding a response body assembled or transformed by Undici.
Record
GHSA-8xcm-r25x-g524
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
NVD 4.8

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Record
CVE-2026-16728
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-444
Updated
2026-11-02
OSV 4.8

undici vulnerable to downstream response desynchronization via retry interceptor

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Record
CVE-2026-16728
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVDEBIAN-CVE-2026-16728 6.5

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Record
DEBIAN-CVE-2026-16728
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 15 moreShow less
OSVGHSA-8xcm-r25x-g524 4.8

undici vulnerable to downstream response desynchronization via retry interceptor

Impact

Undici's interceptors.retry() can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry() and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale Content-Length header. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata.

A malicious or faulty upstream can respond to a range request with a 206 Partial Content response such as:

Content-Range: bytes 0-99/300
Content-Length: 300

and then send only 99 bytes before closing the socket. interceptors.retry() can then retry with Range: bytes=99-99, receive the final byte, and deliver a 100-byte body to the application while the response headers still contain Content-Length: 300 from the first response.

The bug requires interceptors.retry() to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculate Content-Length.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.

Workarounds

  • Disable interceptors.retry() for untrusted upstreams.
  • Remove or recalculate Content-Length before forwarding a response body assembled or transformed by Undici.
Record
GHSA-8xcm-r25x-g524
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVRHSA-2026:48273 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:48273
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:48537 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:48537
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-16728 4.8

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

Record
UBUNTU-CVE-2026-16728
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVCLSA-2026-1790542220 No score

TuxCare security update for undici (12 CVEs)

TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.

Record
CLSA-2026-1790542220
Updated
2026-11-02
OSVCLSA-2026-1791028079 No score

TuxCare security update for undici (11 CVEs)

TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.

Record
CLSA-2026-1791028079
Updated
2026-11-02
OSVCLSA-2026-1791028234 No score

TuxCare security update for undici (3 CVEs)

TuxCare rebuilt undici to address 3 CVEs. Fixed in 7.28.0-tuxcare.7.

Record
CLSA-2026-1791028234
Updated
2026-11-02
OSVCLSA-2026-1791973587 No score

TuxCare security update for undici (15 CVEs)

TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1791973587
Updated
2026-11-02
OSVCLSA-2026-1792451423 No score

TuxCare security update for undici (5 CVEs)

TuxCare rebuilt undici to address 5 CVEs. Fixed in 7.24.4-tuxcare.1.

Record
CLSA-2026-1792451423
Updated
2026-11-02
OSVCLSA-2026-1792867313 No score

TuxCare security update for undici-types (15 CVEs)

TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.

Record
CLSA-2026-1792867313
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-16728 No score

CVE-2026-16728 in undici - Patched by Root

Root has patched CVE-2026-16728 in the undici package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-16728
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02
OSVSUSE-SU-2026:4248-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4248-1
Updated
2026-11-02
OSVSUSE-SU-2026:4261-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4261-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
undici
npm
 before 6.28.0
6.28.0
undici
npm
 7.0.0 up to 7.29.0
7.29.0
undici
npm
 8.0.0 up to 8.9.0
8.9.0
undici
TuxCare:npm
From an advisory covering 12 CVEs
 6.19.7-tuxcare.0 up to 6.19.7-tuxcare.1, plus listed versions
6.19.7
6.19.7-tuxcare.1
undici
TuxCare:npm
From an advisory covering 11 CVEs
 6.19.5-tuxcare.0 up to 6.19.5-tuxcare.2, plus listed versions
6.19.56.19.5-tuxcare.1
6.19.5-tuxcare.2
undici
TuxCare:npm
From an advisory covering 3 CVEs
 7.28.0-tuxcare.0 up to 7.28.0-tuxcare.7, plus listed versions
7.28.07.28.0-tuxcare.17.28.0-tuxcare.27.28.0-tuxcare.37.28.0-tuxcare.47.28.0-tuxcare.57.28.0-tuxcare.6
7.28.0-tuxcare.7
undici
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
undici
TuxCare:npm
From an advisory covering 5 CVEs
 7.24.4-tuxcare.0 up to 7.24.4-tuxcare.1, plus listed versions
7.24.4
7.24.4-tuxcare.1
undici-types
TuxCare:npm
From an advisory covering 15 CVEs
 6.20.0-tuxcare.0 up to 6.20.0-tuxcare.3, plus listed versions
6.20.06.20.0-tuxcare.16.20.0-tuxcare.2
6.20.0-tuxcare.3
node-undici
Debian:12
 All versions, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u15.15.0+dfsg1+~cs20.10.9.3-1+deb12u25.15.0+dfsg1+~cs20.10.9.3-1+deb12u35.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
Show 35 moreShow less
5.19.1+dfsg1+~cs20.10.9.5-15.19.1+dfsg1+~cs20.10.9.5-25.22.1+dfsg1+~cs20.10.10.2-15.26.3+dfsg1+~cs23.10.12-15.26.3+dfsg1+~cs23.10.12-25.26.3+dfsg1+~cs23.10.12-35.28.0+dfsg1+~cs23.11.12.3-15.28.0+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-15.28.2+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-35.28.2+dfsg1+~cs23.11.12.3-45.28.2+dfsg1+~cs23.11.12.3-55.28.2+dfsg1+~cs23.11.12.3-65.28.4+dfsg1+~cs23.12.11-15.28.4+dfsg1+~cs23.12.11-27.1.0+dfsg1+~cs24.12.10-17.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.2.3+dfsg1+~cs24.12.11-17.2.3+dfsg1+~cs24.12.11-27.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
Show 39 moreShow less
Affected packages
PackageAffectedFixed
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 11 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.10.2+dfsg+~cs3.2.2-18.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 8.9.0+dfsg+~cs3.2.0-1, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 9 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-3
8.9.0+dfsg+~cs3.2.0-1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.17.0-1.26.5.1.1.5.hum1
0:11.17.0-1.26.5.1.1.5.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:11.16.0-1.24.18.1.0.1.hum1
0:11.16.0-1.24.18.1.0.1.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
undici
Root:npm
 before 6.26.0-aikido.3
6.26.0-aikido.36.26.0-aikido.46.26.0-aikido.56.21.1-aikido.46.21.1-aikido.57.29.0-aikido.17.29.0-aikido.26.28.0-aikido.17.29.0-aikido.36.28.0-aikido.27.29.0-aikido.47.29.0-aikido.56.28.0-aikido.37.29.0-aikido.6
@rootio/undici
Root:npm
 before 6.26.0-root.io.3
6.26.0-root.io.36.26.0-root.io.46.26.0-root.io.56.21.1-root.io.46.21.1-root.io.57.29.0-root.io.17.29.0-root.io.26.28.0-root.io.17.29.0-root.io.36.28.0-root.io.27.29.0-root.io.47.29.0-root.io.56.28.0-root.io.37.29.0-root.io.6
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs18
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
node-undici
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.22.1+dfsg1+~cs20.10.10.2-1ubuntu15.26.3+dfsg1+~cs23.10.12-2
 None known
node-undici
Ubuntu:26.10
 All versions, plus listed versions
7.18.2+dfsg+~cs3.2.0-1build17.24.6+dfsg+~cs3.2.0-38.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.3.0+dfsg1+~cs24.12.11-27.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.18.2+dfsg+~cs3.2.0-1build1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16728 is a medium vulnerability (CVSS 4.8) in Nodejs Undici, published July 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in undici 6.28.0.

References

Show 182 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open