CVE-2026-18540
Received Received - Intake

HTTP/1.1 Response Splitting in Undici

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-18540
EUVD
EUVD-2026-71661

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
undici undici to 6.28.1 (exc)
undici undici From 7.0.0 (inc) to 7.29.1 (inc)
undici undici From 8.0.0 (inc) to 8.10.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves undici's retry interceptor incorrectly handling partial HTTP responses. When a server sends part of a response and then closes the connection, the interceptor may append additional bytes from a resumed request to the original partial response. This causes the total response body to exceed the declared Content-Length header. If an application forwards this malformed response without adjusting the framing, it can lead to downstream response splitting or desynchronization attacks.

Detection Guidance

Detection requires monitoring for response body length mismatches with Content-Length headers. Check if your undici version is affected (before 6.28.1, 7.0.0-7.29.1, or 8.0.0-8.10.2). Inspect HTTP responses for abnormal body sizes or malformed ranges.

Impact Analysis

If you use an affected version of undici and your application forwards HTTP responses through a framing-sensitive path, an attacker could exploit this to inject malicious data into responses. This could allow them to manipulate responses seen by clients, potentially leading to session hijacking, data theft, or other attacks depending on the application's use case.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling downstream response splitting or desynchronization. If exploited, it may allow attackers to inject malicious content into responses, which could lead to unauthorized data exposure or manipulation. This violates principles of data integrity and confidentiality required by these regulations.

Mitigation Strategies

Upgrade undici to version 6.28.1, 7.29.1, or 8.10.2 or later. If upgrading is not possible, disable the retry interceptor or avoid forwarding responses through framing-sensitive paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart