# CVE-2026-18540: Node.js undici downstream response splitting via retry interceptor

Source: https://junglewise.ai/threats/cve-2026-18540-node-js-undici-downstream-response-splitting-via-retry  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18540 · Severity: low · CVSS 3.7 · Published 2026-09-04

undici is a popular HTTP client library for Node.js used in web servers and proxy applications. A flaw in its automatic retry logic can cause it to combine bytes from multiple server responses into a single response body while maintaining the original response's headers, allowing attackers to inject malicious content that appears to be part of a legitimate response. Applications forwarding this malformed response downstream without recalculating content framing can emit HTTP smuggling attacks that breach security boundaries between requests.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-18540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18540 being exploited in the wild.

**How severe is CVE-2026-18540?** Low severity, with a CVSS score of 3.7, published 4 September 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=0,fixed=6.28.1.

**Is there a fix for CVE-2026-18540?** Yes. undici (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18540 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18540?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 6.28.1 or later

  ```sh
  npm install undici@6.28.1
  ```


## Technical details

A response splitting vulnerability exists in undici's retry interceptor when retrying partial responses. When an upstream server delivers a partial response (e.g., 404 or 206 Partial Content) and then closes, undici may retry the request with a Range header. The interceptor incorrectly appends bytes from the resumed response to the already-delivered partial body while preserving the original response's status, headers, and Content-Length. An attacker controlling the upstream server can deliver a response with mismatched Content-Length and actual body size, causing downstream proxies or gateways to interpret excess bytes as a new HTTP response, enabling HTTP request/response smuggling (CWE-444). Exploitation requires the retry interceptor to be enabled, an attacker-controlled upstream server, and a downstream application that forwards responses without normalizing content framing. Patches are available in undici 6.28.1, 7.29.1, and 8.10.2.

## Affected products

- OpenJS Foundation undici before 6.28.1, 7.0.0 through 7.29.0, 8.0.0 through 8.10.1

## Identifiers

- CVE-2026-18540
- GHSA-r53p-7pc4-xj5r

## Timeline

- 2026-09-04: disclosed
- 2026-09-04: patched: undici 6.28.1, 7.29.1, and 8.10.2 released

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r](https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)