undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.

This Low impact flaw in the undici HTTP client's retry interceptor can lead to HTTP response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards responses without proper framing normalization. Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0 on the retry interceptor configuration. Alternatively, remove or recalculate the Content-Length header before forwarding a response body assembled by undici to downstream HTTP/1.1 peers. Red Hat Hardened Images 2026-09-09T00:00:00Z RHSA-2026:66008 grafana12-4-main-12.4.10-0.2.hum1 Red Hat Hardened Images 2026-09-11T00:00:00Z RHSA-2026:66605 nodejs26-main-26.8.2-0.1.hum1 Exploit Intelligence Out of support scope exploit-intelligence/vulnerability-analysis-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat AMQ Broker 7 Fix deferred amq-broker-bin.zip Red Hat AMQ Broker 7 Fix deferred amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2 Fix deferred automation-platform-ui Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Fix deferred grafana Red Hat Enterprise Linux 10 Fix deferred nodejs22 Red Hat Enterprise Linux 10 Fix deferred nodejs24 Red Hat Enterprise Linux 10 Fix deferred nodejs26 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24-minimal Red Hat Enterprise Linux 8 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 8 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24 Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24-minimal Red Hat Enterprise Linux 9 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:26/nodejs Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24 Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24-minimal Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Affected nodejs24 Red Hat Hardened Images Fix deferred nodejs25 Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-core-bff-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-operator-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred wasmedge Red Hat Openshift Data Foundation 4 Fix deferred odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/pluginregistry-rhel9 Red Hat Trusted Artifact Signer Out of support scope rhtas/rhtas-console-ui-rhel9 Secrets Management Console for Red Hat OpenShift Out of support scope external-secrets-management/console-plugin-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-18540 https://nvd.nist.gov/vuln/detail/CVE-2026-18540 https://cna.openjsf.org/security-advisories.html https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r