CVE-2026-18540

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.

This Low impact flaw in the undici HTTP client's retry interceptor can lead to HTTP response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards responses without proper framing normalization.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0 on the retry interceptor configuration. Alternatively, remove or recalculate the Content-Length header before forwarding a response body assembled by undici to downstream HTTP/1.1 peers.