EUVD-2026-71661
GHSA-r53p-7pc4-xj5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconControl upstream origin server
-
DeliveryDeliver partial response body and close connection
-
Exploitundici retries with HTTP Range request
-
InstallServer returns excess bytes appended to already-forwarded content
-
C2Application forwards oversized body without framing normalization
-
ExecuteDownstream HTTP/1.1 client parses excess bytes as new response
-
ImpactAttacker-controlled response injected into downstream session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
|
| Exploitation Conditions | Two simultaneous conditions are required: (1) The attacker must control the upstream server that undici connects to - this is not a standard SSRF scenario; the attacker must own or influence the origin so it deliberately delivers a partial response, closes the connection, and then answers the Range retry with additional bytes. (2) The vulnerable application must relay undici's response body to a downstream HTTP/1.1 peer without normalizing framing - that is, without buffering the body and truncating or re-declaring Content-Length. Applications that consume the response body internally without forwarding it are not vulnerable to the smuggling impact. The AC:H CVSS metric correctly captures that both conditions must hold simultaneously. Default outbound fetch() usage in Node.js applications that do not act as proxies or API gateways is not susceptible to this attack. |
| Impact | The CVSS score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N correctly reflects the substantial exploitation prerequisites: an attacker must simultaneously control the upstream origin server and rely on the vulnerable application forwarding responses without framing normalization. These joint conditions sharply limit opportunistic or automated exploitation - even a mid-sized municipal IT team in olsztyn operating a Node.js reverse proxy would face this risk only on paths that relay external upstream responses to downstream HTTP/1.1 clients without buffering or re-framing. No EPSS data was provided, no KEV listing exists, and no public POC has been identified at time of analysis. Despite the low severity score, the architectural risk in API gateway and reverse proxy deployments is disproportionately higher than the CVSS suggests, because a successful smuggling chain can allow an attacker to inject arbitrary HTTP responses that appear to originate from a trusted upstream. |
| Exploit ScenarioDerived | An attacker operates a malicious upstream server and engineers a Node.js reverse proxy - using a vulnerable undici version - to fetch from it. The server delivers a partial response body and closes the connection; undici's retry interceptor resumes with a Range request, and the server returns additional bytes that are appended to already-forwarded content. The downstream HTTP/1.1 client, observing a body longer than the forwarded Content-Length, parses the excess bytes as the beginning of a new HTTP response, allowing the attacker to inject a crafted response that appears to originate from the trusted upstream endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
HTTP response splitting and downstream desynchronization in undici's retry interceptor allows an attacker-controlled upstream server to cause downstream HTTP/1.1 clients to misinterpret response boundaries. Affected releases are undici before 6.28.1, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1. When a proxying application relays the malformed response without normalizing framing, excess bytes appended by the retry interceptor can be parsed by a downstream HTTP/1.1 peer as the start of a subsequent response, enabling response injection or session desynchronization attacks.
RemediationAI
Upgrade undici to one of the three patched releases: 6.28.1, 7.29.1, or 8.10.2, all of which correct the retry interceptor's framing behavior as confirmed by the vendor advisory at https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r. If an immediate upgrade is not feasible, the primary compensating control is to disable undici's retry interceptor on code paths that forward responses to downstream HTTP/1.1 clients, eliminating the range-resume logic entirely. Alternatively, applications can buffer the full response body and re-emit it with a corrected Content-Length before forwarding downstream, though this introduces memory overhead proportional to response size and latency on large transfers. Applications that consume undici responses internally without forwarding them to another HTTP peer are not exposed to the smuggling impact and may deprioritize, but patching is still advisable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
undici (CPE: cpe:2.3:a:undici:undici) is Node.js's native HTTP/1.1 client library and the engine powering the built-in fetch() API introduced in Node.js 18. The defect is in its retry interceptor, which resumes interrupted transfers via HTTP Range requests. CWE-444 (Inconsistent Interpretation of HTTP Requests/'HTTP Request/Response Smuggling') describes the root cause: when an upstream server delivers a partial body and closes the connection, the interceptor retries using a Range header and appends the resumed bytes to content already forwarded - while preserving the original status code and Content-Length. The resulting body length exceeds the declared Content-Length, producing a framing inconsistency that HTTP/1.1 message boundaries cannot survive. This breaks the invariant that a response body must not exceed its Content-Length.
Know when Undici gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H reflects the dual prerequisite of attacker-controlled upstream plus a framing-sensitive forwarding path; no confidentiality or availability impact applies.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Blast Radius
ecosystem impact- 28 npm packages depend on undici (16 direct, 23 indirect)
Ecosystem-wide dependent count for version 7.0.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions
Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0
Persistent cache poisoning and disclosure of user-specific responses affect undici 7.0.0 through 7.30.0 and 8.0.0 throug
Exploit-DB