Skip to main content

undici CVE-2026-16728

| EUVDEUVD-2026-50566 MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2026-07-29 openjs GHSA-8xcm-r25x-g524
Information Disclosure Red Hat Request Smuggling Undici Suse
6.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (openjs) PRIMARY
MEDIUM
qualitative
NVD
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
4.8 MEDIUM

AV:N because attacker operates an upstream server reachable over the network; AC:H for the three required co-conditions; C:L/I:L for downstream response leakage and corruption; A:N because availability impact is incidental and bounded.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
4.8 MEDIUM
qualitative

Primary rating from Vendor (openjs).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
CVSS changed
Aug 04, 2026 - 14:23 NVD
4.8 (MEDIUM) 6.5 (MEDIUM)
Patch available
Jul 29, 2026 - 22:02 EUVD
Analysis Generated
Jul 29, 2026 - 21:32 vuln.today
CVE Published
Jul 29, 2026 - 20:59 cve.org
MEDIUM 4.8

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

AnalysisAI

Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.

Technical ContextAI

undici (CPE: cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:*) is the high-performance HTTP/1.1 client library bundled with Node.js 18+ and widely adopted as a standalone npm package. Its retry interceptor is designed to transparently resume partial responses when an upstream connection drops mid-transfer. CWE-444 (Inconsistent Interpretation of HTTP Requests/Responses - HTTP Smuggling) identifies the root cause: the retry interceptor re-assembles the response body across reconnections but does not re-validate or recalculate the Content-Length header from the original response. When the upstream intentionally sends a Transfer-Encoding/Content-Length mismatch and drops the socket, the reassembled body can differ in length from the header the client application ultimately exposes. Applications that act as proxies or gateways - reading undici's response and forwarding raw headers and body downstream - will propagate the stale Content-Length, causing HTTP framing violations at the downstream layer consistent with classic response smuggling primitives.

RemediationAI

Upgrade undici to one of the fixed releases: 6.28.0 (for consumers on the 6.x line), 7.29.0 (for 7.x consumers), or 8.9.0 (for 8.x consumers). These versions are confirmed fixed per the OpenJSF advisory at https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524. If an immediate upgrade is not feasible, the most targeted compensating control is to disable the retry interceptor in undici's configuration - this directly removes the vulnerable code path, though it eliminates automatic retry behavior and may increase error rates against flaky upstreams. A second mitigation for proxy or gateway deployments is to strip or recalculate the Content-Length header before forwarding downstream responses; this prevents the smuggling framing violation from propagating even if the retry interceptor assembles a mismatched body, though it does not fix the underlying desynchronization. Both workarounds carry operational trade-offs and should be treated as temporary measures pending upgrade.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-84961 CRITICAL
9.1 Sep 04

TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - includ
CVE-2026-6734 HIGH
8.8 Jun 17

Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2026-88773 CRITICAL POC
9.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-16728 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy