Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-18540— undici vulnerable to downstream response splitting via retry interceptor

Quick assessment

Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

undici 的重试拦截器可以将一个范围重试响应（ranged retry response）的响应体内容，追加到此前从较早的部分响应中已交付的字节之后，同时仍显示原始响应的状态码和头部信息。这种情况发生在上游服务器在未提供可靠的重试检查点的情况下交付了部分响应体（例如：已发送头部的非成功响应，或内容范围不可用的部分内容响应），随后关闭连接，并针对恢复的范围请求返回更多字节。其结果是，应用观察到的响应体可能比其看到的 更长。如果应用程序在将此类响应转发给下游 HTTP/1.1 对等方时未对帧结构（framing）进

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1595 · Active Scanning

Affected Version Matrix 6

VendorProduct Version RangeStatus
undici undici < 6.28.1 affected
6.28.1 unaffected
7.0.0< 7.29.1 affected
7.29.1 unaffected
8.0.0< 8.10.2 affected
8.10.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18540

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
undici vulnerable to downstream response splitting via retry interceptor
Source: CVE Program / CVE List V5
Vulnerability Description
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
undici undici 0 ~ 6.28.1 -

II. Public POCs for CVE-2026-18540

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18540

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-18540 (1)

Same Patch Batch · undici · 2026-09-04 · 11 CVEs total

CVE-2026-19534 7.5 HIGH undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
CVE-2026-85152 7.4 HIGH undici vulnerable to cross-origin cache poisoning via missing origin isolation in intercep
CVE-2026-84961 7.4 HIGH undici vulnerable to TLS certificate validation bypass via dropped connect options in Bala
CVE-2026-84933 6.5 MEDIUM undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
CVE-2026-85024 5.9 MEDIUM undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate
CVE-2026-85014 5.9 MEDIUM undici vulnerable to Denial of Service via WebSocketStream unclean close
CVE-2026-18149 5.9 MEDIUM undici vulnerable to Denial of Service via orphaned RetryHandler response body
CVE-2026-84890 5.9 MEDIUM undici vulnerable to Denial of Service via unbounded decompression of compressed responses
CVE-2026-85008 3.7 LOW undici vulnerable to caching and replay of unsafe HTTP method responses
CVE-2026-84947 3.7 LOW undici vulnerable to response truncation via oversized chunked responses in the dump inter

IV. Related Vulnerabilities

Same product: undici
Same vendor: undici
Same weakness: CWE-444

V. Comments for CVE-2026-18540

No comments yet

Leave a comment