Intel

AIKIDO-2026-253444

undici is vulnerable to HTTP Request/Response Smuggling

HTTP Request/Response SmugglingCVE-2026-18540 Published Sep 18, 2026

37

Low Risk

This Affects:

JSundici
0.0.1 - 6.28.0
Fixed in 6.28.1
7.0.0 - 7.29.0
Fixed in 7.29.1
8.0.0 - 8.10.1
Fixed in 8.10.2
Are you affected? Scan for Free

TL;DR

The retry interceptor can resume a truncated response and append the resumed bytes onto a body already delivered under the original status and headers. When that response carried a Content-Length, the application receives a longer body than the header describes. A proxy that forwards those status, headers, and body without recalculating framing can emit excess bytes that a downstream peer reads as the next HTTP response. The fix avoids splicing a resumed body onto bytes already delivered under the original headers.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use interceptors.retry().

Background info

undici is vulnerable to HTTP Request/Response Smuggling in versions 0.0.1 - 6.28.0, 7.0.0 - 7.29.0 and 8.0.0 - 8.10.1.

How to fix this

Upgrade the undici library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform