CVE-2026-16728

Analyzed Analyzed - Analysis Complete

HTTP Response Desynchronization in Undici Retry Interceptor

Publication date: 2026-07-29

Last updated on: 2026-08-04

Assigner: openjs

Description

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16728

EUVD

EUVD-2026-50566

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	undici	From 7.0.0 (inc) to 7.29.0 (exc)
nodejs	undici	From 8.0.0 (inc) to 8.9.0 (exc)
nodejs	undici	to 6.28.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves undici's retry interceptor incorrectly handling response body lengths after a retry or partial response. A faulty upstream server can send a mismatched Content-Length header and close the connection early. The interceptor then assembles a body of incorrect length while retaining the original header, causing invalid HTTP responses.

Detection Guidance

Detection requires checking if your system uses undici versions affected by this issue (6.x before 6.28.0, 7.x before 7.29.0, or 8.x before 8.9.0) and if the retry interceptor is enabled. Inspect installed versions with commands like 'npm list undici' or 'node -e "console.log(require('undici/package.json').version)"'.

Impact Analysis

If you use undici with the retry interceptor enabled, this flaw could cause downstream systems to receive corrupted responses, leading to connection hangs, desynchronization, or incorrect data processing. Exploitation requires a malicious or faulty upstream server and a downstream forwarder that does not adjust Content-Length headers.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by causing data integrity issues. If exploited, it may lead to response corruption or desynchronization, which could result in unauthorized data exposure or improper handling of sensitive information. However, specific compliance impacts depend on system configuration and use case.

Mitigation Strategies

Upgrade undici to a fixed version: 6.28.0 or later, 7.29.0 or later, or 8.9.0 or later. If using a proxy or gateway, ensure it recalculates or removes the Content-Length header before forwarding responses.

Hi! I’m here to help you understand CVE-2026-16728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70