Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-29T20:59:02 undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-444

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to downstream applications, such as proxies or gateways, sending invalid HTTP responses, potentially causing response desynchronization, connection hangs, or data corruption for clients.

Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48273 nodejs26-main-26.5.1-1.5.hum1 Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48537 nodejs24-main-24.18.1-0.1.hum1 Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Will not fix nodejs25 Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected rust https://www.cve.org/CVERecord?id=CVE-2026-16728 https://nvd.nist.gov/vuln/detail/CVE-2026-16728 https://cna.openjsf.org/security-advisories.html https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524