Intel

AIKIDO-2026-253444

undici is vulnerable to HTTP Request/Response Smuggling

CVE-2026-18540Published Sep 18, 2026
September 18, 2026

37

CVE Score

Low

HTTP Request/Response Smuggling

Are you affected? Scan for Free

TL;DR

The retry interceptor can resume a truncated response and append the resumed bytes onto a body already delivered under the original status and headers. When that response carried a Content-Length, the application receives a longer body than the header describes. A proxy that forwards those status, headers, and body without recalculating framing can emit excess bytes that a downstream peer reads as the next HTTP response. The fix avoids splicing a resumed body onto bytes already delivered under the original headers.

How do I fix this?

Upgrade the undici library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use interceptors.retry().

Package

Versions

0.0.1 - 6.28.0

Fixed in 6.28.1

7.0.0 - 7.29.0

Fixed in 7.29.1

8.0.0 - 8.10.1

Fixed in 8.10.2

Background info

undici is vulnerable to HTTP Request/Response Smuggling in versions 0.0.1 - 6.28.0, 7.0.0 - 7.29.0 and 8.0.0 - 8.10.1.

Get secure today,
quickly and for free.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.

No credit card required | Scan results in 32 seconds.

Trusted by 150k+ orgs
  • Revolut
  • n8n
  • Lovable
  • Deel
  • Prove
  • Omnea