{"id":"CVE-2026-18540","aliases":["AZL-99939","CLSA-2026-1790755997","CLSA-2026-1790854818","CLSA-2026-1791666983","CLSA-2026-1791798691","CLSA-2026-1791814910","CLSA-2026-1791889848","CLSA-2026-1791908544","CLSA-2026-1791969425","CLSA-2026-1791969916","CLSA-2026-1792478858","CLSA-2026-1792867309","CLSA-2026-1792867312","DEBIAN-CVE-2026-18540","EUVD-2026-71661","GHSA-jr45-8vmc-qm54","GHSA-r53p-7pc4-xj5r","GHSA-vmh5-mc38-953g","RHSA-2026:66008","RHSA-2026:66605","RHSA-2026:71017","UBUNTU-CVE-2026-18540"],"status":"published","title":"undici vulnerable to downstream response splitting via retry interceptor","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00309,"percentile":0.23979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-09-04T17:15:50Z","modified":"2026-11-05T14:17:25Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["6.28.1","7.29.1","8.10.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"undici","fixed_in":["7.29.0-tuxcare.3","7.28.0-tuxcare.5","6.20.0-tuxcare.2","6.19.7-tuxcare.4","6.11.1-tuxcare.6","5.28.5-tuxcare.9","5.29.0-tuxcare.7"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"undici-types","fixed_in":["7.29.0-tuxcare.3","6.20.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["8.10.2+dfsg+~cs3.2.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.28.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.29.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.10.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.22.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.29.0-tuxcare.0"},{"fixed":"7.29.0-tuxcare.3"}]}],"versions":["7.29.0","7.29.0-tuxcare.1","7.29.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.28.0-tuxcare.0"},{"fixed":"7.28.0-tuxcare.5"}]}],"versions":["7.28.0","7.28.0-tuxcare.1","7.28.0-tuxcare.2","7.28.0-tuxcare.3","7.28.0-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.2"}]}],"versions":["6.20.0","6.20.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.7-tuxcare.0"},{"fixed":"6.19.7-tuxcare.4"}]}],"versions":["6.19.7","6.19.7-tuxcare.1","6.19.7-tuxcare.2","6.19.7-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.5-tuxcare.0"},{"fixed":"6.19.5-tuxcare.4"}]}],"versions":["6.19.5","6.19.5-tuxcare.1","6.19.5-tuxcare.2","6.19.5-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.28.0-tuxcare.0"},{"fixed":"6.28.0-tuxcare.2"}]}],"versions":["6.28.0","6.28.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.1-tuxcare.0"},{"fixed":"6.11.1-tuxcare.6"}]}],"versions":["6.11.1","6.11.1-tuxcare.1","6.11.1-tuxcare.2","6.11.1-tuxcare.3","6.11.1-tuxcare.4","6.11.1-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.28.5-tuxcare.0"},{"fixed":"5.28.5-tuxcare.9"}]}],"versions":["5.28.5","5.28.5-tuxcare.1","5.28.5-tuxcare.2","5.28.5-tuxcare.3","5.28.5-tuxcare.4","5.28.5-tuxcare.5","5.28.5-tuxcare.6","5.28.5-tuxcare.7","5.28.5-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.29.0-tuxcare.0"},{"fixed":"5.29.0-tuxcare.7"}]}],"versions":["5.29.0","5.29.0-tuxcare.1","5.29.0-tuxcare.2","5.29.0-tuxcare.3","5.29.0-tuxcare.4","5.29.0-tuxcare.5","5.29.0-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.4-tuxcare.0"},{"fixed":"7.24.4-tuxcare.2"}]}],"versions":["7.24.4","7.24.4-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.29.0-tuxcare.0"},{"fixed":"7.29.0-tuxcare.3"}]}],"versions":["7.29.0","7.29.0-tuxcare.1","7.29.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.2"}]}],"versions":["6.20.0","6.20.0-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.2+dfsg+~cs3.2.2-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.28.1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.1"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.2.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.1-1.26.8.2.0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.8.2-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","tags":["Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","tags":["web","advisory"]},{"url":"https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548","tags":["web"]},{"url":"https://hackerone.com/reports/3900104","tags":["web"]},{"url":"https://hackerone.com/reports/3900615","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v6.28.1","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v7.29.1","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v8.10.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r53p-7pc4-xj5r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18540.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18540","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66008","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84961","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18540","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84947","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85008","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84890","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85014","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28378","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19197","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66008.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14199","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-14199/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18149","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18540","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19197","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-19197","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28378","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28378","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84961","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85024","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66605.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85024","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85024","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71017","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71017.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-18540","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-18540","title":"undici vulnerable to downstream response splitting via retry interceptor","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T17:15:50.619Z","modified":"2026-09-04T17:50:13.682Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-71661","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T17:15:50Z","modified":"2026-09-04T17:50:13Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:11.774269Z"}],"ghsa":[{"id":"GHSA-r53p-7pc4-xj5r","title":"undici vulnerable to downstream response splitting via retry interceptor","description":"### Impact\n\nUndici's `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a `Content-Length`, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded `Content-Length`, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).\n\nFor example, a `404 Not Found` with `Content-Length: 2` that sends one byte then closes can be resumed with an open-ended `Range` request, and the resumed `206 Partial Content` bytes are appended, so the application receives more than two body bytes while still seeing `Content-Length: 2`. The bug requires `interceptors.retry()` enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate `Content-Length`.\n\n### Patches\n\nPatched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.\n\n### Workarounds\n\n- Disable `interceptors.retry()` for untrusted upstreams, or set `maxRetries: 0`.\n- Remove or recalculate `Content-Length` before forwarding a response body assembled by Undici.","status":"published","published":"2026-09-29T18:22:07Z","modified":"2026-09-29T18:22:08Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-18540","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T18:17:50.02Z","modified":"2026-09-16T20:41:17.627Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"CVE-2026-18540","title":"undici vulnerable to downstream response splitting via retry interceptor","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T17:15:50.619Z","modified":"2026-10-28T02:30:43.968839207Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"DEBIAN-CVE-2026-18540","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T18:17:50.02Z","modified":"2026-10-01T03:02:29.666736078Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"GHSA-r53p-7pc4-xj5r","title":"undici vulnerable to downstream response splitting via retry interceptor","description":"### Impact\n\nUndici's `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a `Content-Length`, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded `Content-Length`, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).\n\nFor example, a `404 Not Found` with `Content-Length: 2` that sends one byte then closes can be resumed with an open-ended `Range` request, and the resumed `206 Partial Content` bytes are appended, so the application receives more than two body bytes while still seeing `Content-Length: 2`. The bug requires `interceptors.retry()` enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate `Content-Length`.\n\n### Patches\n\nPatched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.\n\n### Workarounds\n\n- Disable `interceptors.retry()` for untrusted upstreams, or set `maxRetries: 0`.\n- Remove or recalculate `Content-Length` before forwarding a response body assembled by Undici.","status":"published","published":"2026-09-29T18:22:07Z","modified":"2026-09-29T18:30:41.154532067Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RHSA-2026:66008","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-10T10:17:09Z","modified":"2026-10-20T10:43:33.340874063Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66605","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-12T10:10:21Z","modified":"2026-10-20T10:13:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:71017","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-30T10:16:55Z","modified":"2026-10-20T10:14:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-18540","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T18:17:00Z","modified":"2026-10-17T12:56:47.257176157Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"AZL-99939","title":"CVE-2026-18540 affecting package nodejs 24.22.1-1","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","status":"published","published":"2026-09-04T18:17:50Z","modified":"2026-11-05T14:17:25.102627954Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"CLSA-2026-1790755997","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 7.29.0-tuxcare.3.","status":"published","published":"2026-09-30T08:13:17Z","modified":"2026-10-25T01:30:03.427632573Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790854818","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.5.","status":"published","published":"2026-10-01T11:40:18Z","modified":"2026-10-15T09:47:59.986193283Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791666983","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.20.0-tuxcare.2.","status":"published","published":"2026-10-10T21:16:23Z","modified":"2026-10-24T19:15:03.345433747Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791798691","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.19.7-tuxcare.4.","status":"published","published":"2026-10-12T09:51:31Z","modified":"2026-10-15T09:47:40.10407286Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791814910","title":"TuxCare security update for undici (2 CVEs)","description":"TuxCare rebuilt undici to address 2 CVEs. Fixed in 6.19.5-tuxcare.4.","status":"published","published":"2026-10-12T14:21:50Z","modified":"2026-10-15T09:47:40.344041951Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791889848","title":"TuxCare security update for undici (2 CVEs)","description":"TuxCare rebuilt undici to address 2 CVEs. Fixed in 6.28.0-tuxcare.2.","status":"published","published":"2026-10-13T11:10:48Z","modified":"2026-10-15T09:47:21.170331125Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791908544","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 6.11.1-tuxcare.6.","status":"published","published":"2026-10-13T16:22:24Z","modified":"2026-10-15T09:48:00.178160347Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791969425","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 5.28.5-tuxcare.9.","status":"published","published":"2026-10-14T09:17:05Z","modified":"2026-10-15T09:48:00.180236324Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791969916","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 5.29.0-tuxcare.7.","status":"published","published":"2026-10-14T09:25:16Z","modified":"2026-10-15T09:48:00.127749147Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792478858","title":"TuxCare security update for undici (15 CVEs)","description":"TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.","status":"published","published":"2026-10-20T06:47:38Z","modified":"2026-11-05T13:28:26.36826201Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1792867309","title":"TuxCare security update for undici-types (1 CVE)","description":"TuxCare rebuilt undici-types to address 1 CVE. Fixed in 7.29.0-tuxcare.3.","status":"published","published":"2026-10-24T18:41:47Z","modified":"2026-10-25T01:30:06.321325219Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792867312","title":"TuxCare security update for undici-types (1 CVE)","description":"TuxCare rebuilt undici-types to address 1 CVE. Fixed in 6.20.0-tuxcare.2.","status":"published","published":"2026-10-24T18:41:48Z","modified":"2026-10-25T01:30:04.324790409Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}