Response Desynchronization Vulnerability in Undici by Node.js

CVE-2026-16728

What is CVE-2026-16728?

The vulnerability in Undici allows a malicious or faulty upstream server to return a partial response with an incorrect Content-Length header. When the retry interceptor is enabled, this can lead to the assembly of an invalid body length, causing issues such as connection hangs and corrupted responses. The problem arises when the application's framework does not recalculate or remove the outdated Content-Length header after recovering from a partial response. Proper remediation requires updating Undici to versions 6.28.0, 7.29.0, or 8.9.0.

References