Listen to this Post
Undici’s `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response’s status and headers. When that response carried a Content-Length, the application can receive a longer body. Applications that forward Undici’s status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded Content-Length, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization). For example, a `404 Not Found` with `Content-Length: 2` that sends one byte then closes can be resumed with an open-ended `Range` request, and the resumed `206 Partial Content` bytes are appended, so the application receives more than two body bytes while still seeing Content-Length: 2. The bug requires `interceptors.retry()` enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate Content-Length. Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later. Workarounds include disabling `interceptors.retry()` for untrusted upstreams, or setting maxRetries: 0, and removing or recalculating `Content-Length` before forwarding a response body assembled by Undici. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. The CVE was published on 2026-09-04.
DailyCVE Form:
Platform: Undici
Version: <6.28.1, 7.0.0-7.29.1, 8.0.0-8.10.2
Vulnerability: HTTP Response Splitting
Severity: Low
date: 2026-09-04
Prediction: 2026-09-04
What Undercode Say:
Check installed undici version
npm list undici
Example vulnerable retry interceptor configuration
const { Client, interceptors } = require('undici');
const client = new Client('http://attacker-controlled-upstream', {
interceptors: {
retry: interceptors.retry({ maxRetries: 3 })
}
});
// Vulnerable pattern: forwarding response without recalculating Content-Length
const { statusCode, headers, body } = await client.request({
method: 'GET',
path: '/'
});
// Downstream forwarder that trusts Content-Length
res.writeHead(statusCode, headers);
for await (const chunk of body) {
res.write(chunk); // May write more bytes than Content-Length declares
}
res.end();
Test if a proxy is vulnerable to response splitting curl -v --raw http://target-proxy/attacker-path Look for extra bytes after the declared Content-Length in the response
Exploit: (Educational Purposes!)
- Set up an attacker-controlled upstream server that returns a partial `404 Not Found` response with
Content-Length: 2, sending exactly one byte and then closing the connection. - The Undici client, with `interceptors.retry()` enabled, automatically resumes the request using an open-ended `Range` header.
- The attacker server responds to the resumed request with `206 Partial Content` containing additional bytes (e.g., the start of a second HTTP response).
- Undici appends the resumed bytes to the already-delivered body while still exposing the original `Content-Length: 2` and the original status/headers.
- A downstream proxy or gateway that forwards the response without recalculating framing emits a body that exceeds
Content-Length. - The excess bytes are interpreted by the downstream client as the beginning of a subsequent HTTP response, enabling response splitting or desynchronization.
Protection:
- Upgrade to undici v6.28.1, v7.29.1, or v8.10.2 or later.
- Disable `interceptors.retry()` for untrusted upstreams, or set
maxRetries: 0. - Remove or recalculate `Content-Length` before forwarding a response body assembled by Undici.
Impact:
An attacker-controlled upstream server can cause a downstream proxy or gateway to emit a response whose body exceeds the declared Content-Length. The excess bytes can be read as the start of a subsequent HTTP response, leading to downstream response splitting or desynchronization. This may enable HTTP request smuggling, bypassing security controls, and potentially accessing sensitive data or performing unauthorized actions on behalf of other users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
