CVE-2026-18540: Undici HTTP Response Splitting Vulnerability

CVE-2026-18540 Overview

CVE-2026-18540 affects undici, the HTTP/1.1 client library used by Node.js. The retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. When an application forwards such a response to a downstream HTTP/1.1 peer without normalizing framing, the emitted body can exceed the forwarded Content-Length. Excess bytes may then be parsed as the start of a following response, enabling HTTP response splitting or desynchronization. This weakness is classified under CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
An attacker controlling an upstream server can trigger downstream HTTP request smuggling or response splitting against clients that relay undici responses through framing-sensitive proxies.

Affected Products

undici versions before 6.28.1
undici versions from 7.0.0 up to 7.29.1
undici versions from 8.0.0 up to 8.10.2

Discovery Timeline

2026-09-04 - CVE-2026-18540 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18540

Vulnerability Analysis

The flaw resides in undici's retry interceptor, which resumes interrupted responses using HTTP Range requests. The interceptor concatenates bytes from a resumed range response onto bytes already streamed to the caller, without validating that the original response provided a trustworthy resume checkpoint. The concatenated stream is delivered under the status line and headers of the initial response, including its Content-Length. Applications that forward the response over HTTP/1.1 without re-framing propagate the mismatch. Downstream parsers then interpret trailing bytes as a new HTTP response, corrupting the connection state.

Root Cause

The root cause is missing validation of the resume state before the retry interceptor stitches partial and retry bodies together. Two upstream conditions produce an unsafe resume: a non-success response whose headers were already emitted, and a partial-content response with an unusable Content-Range. In both cases the interceptor treats the second response's body as a continuation rather than an independent response. The library exposes the combined body while preserving the initial response headers, which no longer describe the byte stream.

Attack Vector

Exploitation requires an attacker-controlled upstream HTTP server and a victim application that uses undici with the retry interceptor and forwards the response through a framing-sensitive path such as an HTTP/1.1 proxy or reverse proxy. The attacker's server serves an initial partial response, closes the connection, and returns extra bytes when the client issues the resumed range request. The extra bytes appear on the forwarded connection past the advertised Content-Length, where a downstream parser reads them as the beginning of a subsequent response. This yields HTTP response splitting or request/response desynchronization between the proxy and its clients.

No verified exploitation code is public. See the GitHub Security Advisory GHSA-r53p-7pc4-xj5r for technical details.

Detection Methods for CVE-2026-18540

Indicators of Compromise

Downstream HTTP/1.1 responses whose body length exceeds the advertised Content-Length header on connections proxied through Node.js services.
Proxy or reverse-proxy logs showing unexpected response boundaries, malformed status lines, or parser resets on keep-alive connections.
Application logs from undici showing repeated range-request retries against the same upstream origin followed by anomalous downstream errors.

Detection Strategies

Inventory Node.js services that depend on undici directly or transitively and flag versions below 6.28.1, between 7.0.0 and 7.29.1, or between 8.0.0 and 8.10.2.
Instrument outbound HTTP proxies to compare emitted byte counts against the Content-Length header and alert on divergence.
Enable strict HTTP parsing on downstream proxies to reject responses that contain trailing bytes after the framed body.

Monitoring Recommendations

Monitor for HTTP/1.1 desynchronization symptoms including cross-request response bleed, cache poisoning entries, and unexpected 400-class errors from downstream proxies.
Track dependency manifests (package.json, package-lock.json, yarn.lock) in CI for pinned undici versions in the vulnerable ranges.
Correlate upstream origin reputation with retry-interceptor activity to surface untrusted servers issuing partial-content responses.

How to Mitigate CVE-2026-18540

Immediate Actions Required

Upgrade undici to 6.28.1, 7.29.1, or 8.10.2 depending on the major version in use.
Update transitive dependencies by rebuilding lockfiles and redeploying affected Node.js services.
Restrict outbound HTTP traffic from services that relay third-party responses so undici only reaches trusted upstream origins.

Patch Information

The undici maintainers released fixes in versions 6.28.1, 7.29.1, and 8.10.2. Refer to the GitHub Security Advisory GHSA-r53p-7pc4-xj5r and the OpenJS Foundation Security Advisories for release notes and commit references.

Workarounds

Disable the retry interceptor in undici clients that forward responses to downstream HTTP/1.1 peers until upgrade is possible.
Re-frame proxied responses by re-computing Content-Length or using chunked transfer encoding before forwarding.
Terminate HTTP/1.1 keep-alive between the Node.js service and downstream proxies to reduce the impact of desynchronization.

bash

# Upgrade undici to a fixed release
npm install undici@8.10.2
# or, for the 7.x line
npm install undici@7.29.1
# or, for the 6.x line
npm install undici@6.28.1