CVE-2026-18540
published 2026-09-04CVE-2026-18540: undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting…
PriorityP415low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.24%
14.2th percentile
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| grafana | grafana | — | — |
| nodejs | undici | < 6.28.1 | 6.28.1 |
| nodejs | undici | >= 7.0.0 < 7.29.1 | 7.29.1 |
| nodejs | undici | >= 8.0.0 < 8.10.2 | 8.10.2 |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift4 | ose-monitoring-plugin-rhel9 | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-lightspeed-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
undici vulnerable to downstream response splitting via retry interceptor
ghsa·2026-09-29
CVE-2026-18540 [LOW] CWE-444 undici vulnerable to downstream response splitting via retry interceptor
undici vulnerable to downstream response splitting via retry interceptor
### Impact
Undici's `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a `Content-Length`, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded `Content-Length`, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).
For example, a `404 Not Found` with `Content-Len
VulDB
Node.js Undici up to 6.28.0/7.29.1/8.10.2 Retry Interceptor response splitting (Nessus ID 343100)
vuldb·2026-09-05·CVSS 3.7
CVE-2026-18540 [LOW] Node.js Undici up to 6.28.0/7.29.1/8.10.2 Retry Interceptor response splitting (Nessus ID 343100)
A vulnerability was found in Node.js Undici up to 6.28.0/7.29.1/8.10.2. It has been rated as problematic. This vulnerability affects unknown code of the component Retry Interceptor. Performing a manipulation results in http response splitting.
This vulnerability is known as CVE-2026-18540. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is advised.
Red Hat
undici: undici: HTTP response splitting via retry interceptor
vendor_redhat·2026-09-04·CVSS 3.7
CVE-2026-18540 [LOW] CWE-444 undici: undici: HTTP response splitting via retry interceptor
undici: undici: HTTP response splitting via retry interceptor
A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: openshift-pipelines/pipelines-console-plugin-pf5-rhel9 (OpenShift Pipelines) - Fix defer
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18540 fbthrift: undici: HTTP response splitting via retry interceptor [fedora-all]
bugzilla·2026-09-11·CVSS 3.7
CVE-2026-18540 [LOW] CVE-2026-18540 fbthrift: undici: HTTP response splitting via retry interceptor [fedora-all]
CVE-2026-18540 fbthrift: undici: HTTP response splitting via retry interceptor [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed
Bugzilla
CVE-2026-18540 nodejs22: undici: HTTP response splitting via retry interceptor [fedora-all]
bugzilla·2026-09-11·CVSS 3.7
CVE-2026-18540 [LOW] CVE-2026-18540 nodejs22: undici: HTTP response splitting via retry interceptor [fedora-all]
CVE-2026-18540 nodejs22: undici: HTTP response splitting via retry interceptor [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed
Bugzilla
CVE-2026-18540 nodejs20: undici: HTTP response splitting via retry interceptor [fedora-all]
bugzilla·2026-09-11·CVSS 3.7
CVE-2026-18540 [LOW] CVE-2026-18540 nodejs20: undici: HTTP response splitting via retry interceptor [fedora-all]
CVE-2026-18540 nodejs20: undici: HTTP response splitting via retry interceptor [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed
Bugzilla
CVE-2026-18540 nodejs24: undici: HTTP response splitting via retry interceptor [fedora-all]
bugzilla·2026-09-11·CVSS 3.7
CVE-2026-18540 [LOW] CVE-2026-18540 nodejs24: undici: HTTP response splitting via retry interceptor [fedora-all]
CVE-2026-18540 nodejs24: undici: HTTP response splitting via retry interceptor [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed
Bugzilla
CVE-2026-18540 undici: undici: HTTP response splitting via retry interceptor
bugzilla·2026-09-04·CVSS 3.7
CVE-2026-18540 [LOW] CVE-2026-18540 undici: undici: HTTP response splitting via retry interceptor
CVE-2026-18540 undici: undici: HTTP response splitting via retry interceptor
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can
2026-09-04
Published