CVE-2026-16728: Downstream HTTP Response Desynchronization in Undici Retry Interceptor
Vulnerability ID: CVE-2026-16728
CVSS Score: 4.8
Published: 2026-08-03
A medium-severity vulnerability in Undici's retry interceptor causes body-length mismatches with the Content-Length header during HTTP 206 response resumption. Forwarding these inconsistent headers downstream leads to HTTP response desynchronization, connection hangs, or potential protocol smuggling.
TL;DR
Undici's retry interceptor failed to validate the Content-Length header against actual bytes received when retrying broken HTTP 206 Partial Content responses, creating desynchronization risks in downstream proxies.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-444
- Attack Vector: Network
- CVSS v3.1 Score: 4.8
- EPSS Score: 0.00164
- Impact: HTTP Response Desynchronization, Client Connection Hangs, Protocol Smuggling
- Exploit Status: poc
- Kev Status: Not Listed
Affected Systems
- Node.js applications using undici library with retry interceptor enabled
-
undici: < 6.28.0 (Fixed in:
6.28.0) -
undici: >= 7.0.0, < 7.29.0 (Fixed in:
7.29.0) -
undici: >= 8.0.0, < 8.9.0 (Fixed in:
8.9.0)
Code Analysis
Commit: 1b5a531
fix(retry): reject partial content length mismatch
Commit: cba3a52
refactor(retry): abort/reject logic for mismatched partial responses
Exploit Details
- GitHub (Undici Test Suite): Integration and unit tests verifying the detection of range / Content-Length mismatch during failures
Mitigation Strategies
- Upgrade the Undici dependency to a patched version (6.28.0, 7.29.0, or 8.9.0 or higher).
- Recalculate the Content-Length header in middlebox or reverse-proxy code before forwarding headers downstream.
- Strip the Content-Length header and utilize chunked transfer encoding (Transfer-Encoding: chunked) for downstream proxy responses.
Remediation Steps:
- Identify all Node.js projects utilizing the undici library by examining package.json and package-lock.json files.
- Update undici to version 6.28.0 (for 6.x), 7.29.0 (for 7.x), or 8.9.0 (for 8.x) using the package manager.
- Ensure any proxy or gateway routes do not blindly trust and forward the Content-Length header from upstream servers without validation.
- Execute testing suites with test cases that mimic interrupted range responses to verify that connections reject invalid frames appropriately.
References
- GitHub Security Advisory GHSA-8xcm-r25x-g524
- OpenJS Foundation Security Advisories
- CVE-2026-16728 CVE Record
- NVD - CVE-2026-16728 Detail
- Fix Commit in Undici Repository
- Refactor/Abort Commit in Undici Repository
- Test Corrections - Range boundary updates (Commit 1)
- Test Corrections - Range boundary updates (Commit 2)
- Test Corrections - Range boundary updates (Commit 3)
- Undici Release Tag v6.28.0
- Undici Release Tag v7.29.0
- Undici Release Tag v8.9.0
Read the full report for CVE-2026-16728 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)