CVE-2026-16728: undici Retry Interceptor DoS Vulnerability

CVE-2026-16728 Overview

CVE-2026-16728 affects undici, the HTTP/1.1 client library used by Node.js. The retry interceptor can assemble a response body whose length does not match the upstream Content-Length header after retrying or resuming a partial response. A malicious or faulty upstream server can return a partial response with a mismatched framing header, close the socket early, and cause the interceptor to deliver a body of a different length while leaving the original Content-Length header attached. Applications acting as proxies or gateways that forward these headers downstream may emit invalid HTTP responses. The flaw is classified under CWE-444: Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling).

Critical Impact
Downstream HTTP response desynchronization, connection hangs, or response corruption in proxies and gateways that forward upstream headers without recalculating Content-Length.

Affected Products

undici versions prior to 6.28.0
undici versions 7.0.0 up to (but not including) 7.29.0
undici versions 8.0.0 up to (but not including) 8.9.0

Discovery Timeline

2026-07-29 - CVE-2026-16728 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-16728

Vulnerability Analysis

The defect lives in the retry interceptor's response assembly logic. When an upstream server returns a partial response and closes the socket, the interceptor retries or resumes the transfer and stitches together a body from multiple segments. The interceptor does not remove or recalculate the original Content-Length header captured from the first partial response. The header therefore describes a length that does not match the assembled body delivered to the calling application.

Proxy and gateway applications commonly forward upstream headers and bodies verbatim to their own downstream clients. When such an application relays the stale Content-Length alongside a body of different size, the downstream HTTP parser cannot correctly determine message boundaries. This produces classic HTTP framing failures: the client waits for bytes that never arrive, reads bytes belonging to the next response, or terminates the connection prematurely.

Root Cause

The root cause is inconsistent handling of framing headers during retry and resume operations inside the undici retry interceptor. The interceptor treats the response body as recoverable across socket closure but does not treat the framing metadata as invalidated. This is a header-body desynchronization within a single logical response (CWE-444).

Attack Vector

Exploitation requires three conditions to hold at the same time. First, the calling application must have the undici retry interceptor enabled. Second, an upstream server under attacker influence must return a partial response with a mismatched framing header and then close the socket early. Third, a downstream forwarder such as a proxy or gateway must relay upstream headers and bodies without stripping or recomputing Content-Length. When all three conditions are met, the attacker induces response desynchronization on the downstream side. The attack is network-reachable but requires a specific chain of misconfigurations and upstream control, which is reflected in the high attack complexity of the CVSS vector.

No verified public proof-of-concept code is available for CVE-2026-16728. See the GitHub Security Advisory GHSA-8xcm-r25x-g524 for maintainer details.

Detection Methods for CVE-2026-16728

Indicators of Compromise

Downstream HTTP responses where the emitted body length does not equal the value of the Content-Length header.
Client-side errors reporting premature socket closure, hung connections, or malformed responses served by an internal proxy or gateway.
Upstream responses that terminate before delivering the number of bytes advertised in Content-Length, followed by successful retries by the same client process.

Detection Strategies

Inventory Node.js services and audit package-lock.json or yarn.lock for undici versions below 6.28.0, between 7.0.0 and 7.29.0, or between 8.0.0 and 8.9.0.
Identify applications that call undici with the retry interceptor enabled and also forward responses to downstream consumers.
Instrument proxy and gateway services to log any response where the outgoing byte count diverges from the outgoing Content-Length.

Monitoring Recommendations

Alert on spikes in downstream HTTP parser errors, ECONNRESET, and idle connection timeouts on services that depend on undici.
Track anomalous rates of upstream socket closures paired with retry interceptor activity in application logs.
Correlate upstream partial-response events with downstream complaints of corrupted or truncated payloads.

How to Mitigate CVE-2026-16728

Immediate Actions Required

Upgrade undici to 6.28.0, 7.29.0, or 8.9.0 or later depending on the major version in use.
Rebuild and redeploy any container images or serverless bundles that pin a vulnerable undici release, including transitive dependencies pulled in through frameworks and SDKs.
Audit proxy and gateway code paths for use of the retry interceptor combined with header pass-through.

Patch Information

The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. Refer to the GitHub Security Advisory GHSA-8xcm-r25x-g524 and the OpenJSF Security Advisories for maintainer guidance.

Workarounds

Disable the retry interceptor in undici client configurations until the upgrade is applied.
In forwarding logic, strip the incoming Content-Length header and let the downstream HTTP framework recompute it, or switch the forwarded response to chunked transfer encoding.
Reject or discard upstream responses where the received body size does not match the advertised Content-Length before passing them downstream.

bash

# Configuration example
npm install undici@^8.9.0
# or for the 7.x line
npm install undici@^7.29.0
# or for the 6.x line
npm install undici@^6.28.0