CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

• CWE-444

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524Mitigation, Vendor Advisory

Published

Jul 29, 2026

Last Modified

Aug 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16713IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentat…5.3
• CVE-2026-1672The BEAR – Bulk Editor and Products Manager Professional for…6.5
• CVE-2026-16722IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…8.8
• CVE-2026-16723A remote code execution (RCE) vulnerability exists in fastjs…9
• CVE-2026-16724IBM Virtualization Management Interface FW1110.00 through FW…4.5
• CVE-2026-16727Concurrent Execution using Shared Resource with Improper Syn…7.3
• CVE-2026-16729undici's setCookie function does not fully sanitize cookie a…6.5
• CVE-2026-1673The BEAR – Bulk Editor and Products Manager Professional for…4.3
• CVE-2026-16730A flaw was found in dbus-broker. When the process file-descr…5.5
• CVE-2026-16731OMICRON StationScout before version 3.05 contains a cryptogr…8.3
• CVE-2026-16732fastify is a fast and low overhead web framework for Node.js…6.1
• CVE-2026-16733A weakness has been identified in bahmutov find-cypress-spec…5.3