Response Splitting Vulnerability in Undici Affects Multiple Versions

CVE-2026-18540

What is CVE-2026-18540?

The undici library contains a vulnerability where the retry interceptor can append additional bytes from a ranged retry response to an already processed part of an earlier response. This issue arises when an upstream server responds with a non-standard content range or a partial response without a reliable resume checkpoint. If an application forwards this response through a path sensitive to HTTP framing, the response body may exceed the observed Content-Length. Malicious manipulation by an attacker-controlled upstream server can lead to response splitting or desynchronization in downstream applications, potentially compromising data integrity.

References