CVE-2026-18540: Undici Package Vulnerable to Downstream Response Splitting via Retry Interceptor
Summary
CVE-2026-18540: undici vulnerable to downstream response splitting via retry interceptor. Affects undici across 3 version ranges.
< 6.28.1
>= 7.0.0, < 7.29.1
>= 8.0.0, < 8.10.2
Fixed in 6.28.1, 7.29.1 or 8.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is a high-performance HTTP/1.1 client designed for Node.js applications. It provides a simple and efficient way to make HTTP requests, offering features such as connection pooling and request interceptors. However, a vulnerability exists in its retry interceptor functionality, which can lead to security issues when handling responses from upstream servers.
Vulnerability Detail
The vulnerability arises from the interceptors.retry() method in Undici, which can resume a request after a partial response. This allows the resumed bytes to be appended to an already partially delivered body, while the application still receives the original response's status and headers. If the original response includes a Content-Length header, the application may receive a body longer than specified. This can lead to downstream response splitting, where excess bytes are interpreted as the beginning of a new HTTP response. The bug requires the retry interceptor to be enabled, a faulty or attacker-controlled upstream response, and a downstream forwarder that does not recalculate the Content-Length.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.28.16.28.1npm install undici@6.28.1 -
>= 7.0.0, < 7.29.17.29.1npm install undici@7.29.1 -
>= 8.0.0, < 8.10.28.10.2npm install undici@8.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the interceptors.retry() feature for untrusted upstreams by setting maxRetries: 0 in your configuration. Here is an example of how to do this:
const { Client } = require('undici');
const client = new Client('http://example.com', {
interceptors: {
retry: {
maxRetries: 0
}
}
});
Conclusion
The vulnerability CVE-2026-18540 in the Undici package poses a risk of downstream response splitting due to the behavior of the retry interceptor. It is crucial to upgrade to the patched versions or implement workarounds to mitigate this risk. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for undici →
FAQ
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If exploited, this vulnerability can lead to downstream response splitting, allowing attackers to manipulate the response body and potentially execute further attacks.
Yes, you can disable the retry interceptor or recalculate the Content-Length before forwarding responses to mitigate the risk.
The patched versions of Undici are v6.28.1, v7.29.1, and v8.10.2. It is recommended to upgrade to one of these versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for undici.
