CVE-2026-18540: Undici Remote Code Execution Vulnerability

LOW
Advisory Identifier: GHSA-r53p-7pc4-xj5r
Share
CVSS 3.7
CWE-444
Published
Advisory Summary

CVE-2026-18540 is a LOW (CVSS 3.7) remote code execution vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')) affecting Undici libraries in the npm ecosystem. The issue involves undici vulnerable to downstream response splitting via retry interceptor. Remediation is available by upgrading affected packages to version 6.28.1, 7.29.1, 8.10.2.

CVE-2026-18540 at a Glance

CVE Identifier CVE-2026-18540
GHSA Identifier GHSA-r53p-7pc4-xj5r
Severity LOW
CVSS v3.1 Base Score 3.7
CWE Classification CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected Product Undici
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 3.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2026-18540

To remediate this vulnerability, upgrade all affected Undici dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

undici fixed: 6.28.1 
npm install undici@6.28.1
undici fixed: 7.29.1 
npm install undici@7.29.1
undici fixed: 8.10.2 
npm install undici@8.10.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls undici

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-18540, inspect your project dependencies using npm:

npm ls undici

Analyze the terminal output to locate any version of Undici in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.28.1), your application is affected.

Note: The npm ls undici command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), where the product acts as an intermediary http agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed http requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. In Undici, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Undici's `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a `Content-Length`, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded `Content-Length`, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization). For example, a `404 Not Found` with `Content-Length: 2` that sends one byte then closes can be resumed with an open-ended `Range` request, and the resumed `206 Partial Content` bytes are appended, so the application receives more than two body bytes while still seeing `Content-Length: 2`. The bug requires `interceptors.retry()` enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate `Content-Length`. ### Patches Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later. ### Workarounds - Disable `interceptors.retry()` for untrusted upstreams, or set `maxRetries: 0`. - Remove or recalculate `Content-Length` before forwarding a response body assembled by Undici.

CVE-2026-18540 Affected Undici Versions

3 component(s)
Fixed Versions:
6.28.17.29.18.10.2
Product / Package Ecosystem Affected Versions Fixed Version
undici
npm/undici
npm
< 6.28.1
6.28.1
undici
npm/undici
npm
≥ 7.0.0
< 7.29.1
7.29.1
undici
npm/undici
npm
≥ 8.0.0
< 8.10.2
8.10.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r
NVD — CVE-2026-18540 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18540
Security Fix Commit FIX COMMIT
https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329
Security Fix Commit FIX COMMIT
https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95
Security Fix Commit FIX COMMIT
https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548
hackerone.com/reports/3900104 WEB
https://hackerone.com/reports/3900104
hackerone.com/reports/3900615 WEB
https://hackerone.com/reports/3900615
Undici Security Information SECURITY
https://cna.openjsf.org/security-advisories.html
Undici Source Repository REPOSITORY
https://github.com/nodejs/undici
Undici Release RELEASE
https://github.com/nodejs/undici/releases/tag/v6.28.1
Undici Release RELEASE
https://github.com/nodejs/undici/releases/tag/v7.29.1
Undici Release RELEASE
https://github.com/nodejs/undici/releases/tag/v8.10.2

Frequently Asked Questions

What is CVE-2026-18540?
CVE-2026-18540 is a security vulnerability in Undici involving undici vulnerable to downstream response splitting via retry interceptor under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling').
Which Undici versions are affected?
Affected versions include releases prior to 6.28.1, 7.29.1, 8.10.2 across affected packages: undici.
What version fixes CVE-2026-18540?
Upgrading to 6.28.1, 7.29.1, 8.10.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is undici affected?
Yes, undici is affected in releases prior to 6.28.1, 7.29.1, 8.10.2. Upgrade your dependency to 6.28.1, 7.29.1, 8.10.2 or later.
What is the CVSS score of CVE-2026-18540?
CVE-2026-18540 has a CVSS v3.1 base score of 3.7 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
What CWE is associated with CVE-2026-18540?
CVE-2026-18540 is classified under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.).
How can I check npm dependencies for CVE-2026-18540?
Run the dependency tree command: 'npm ls undici'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r53p-7pc4-xj5r",
  "modified" : "2026-09-29T18:22:07Z",
  "published" : "2026-09-29T18:22:07Z",
  "aliases" : [ "CVE-2026-18540" ],
  "summary" : "undici vulnerable to downstream response splitting via retry interceptor",
  "details" : "### Impact\n\nUndici's `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a `Content-Length`, the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded `Content-Length`, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).\n\nFor example, a `404 Not Found` with `Content-Length: 2` that sends one byte then closes can be resumed with an open-ended `Range` request, and the resumed `206 Partial Content` bytes are appended, so the application receives more than two body bytes while still seeing `Content-Length: 2`. The bug requires `interceptors.retry()` enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate `Content-Length`.\n\n### Patches\n\nPatched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.\n\n### Workarounds\n\n- Disable `interceptors.retry()` for untrusted upstreams, or set `maxRetries: 0`.\n- Remove or recalculate `Content-Length` before forwarding a response body assembled by Undici.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "undici"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.28.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "undici"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.29.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "undici"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.0.0"
      }, {
        "fixed" : "8.10.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-18540"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548"
  }, {
    "type" : "WEB",
    "url" : "https://hackerone.com/reports/3900104"
  }, {
    "type" : "WEB",
    "url" : "https://hackerone.com/reports/3900615"
  }, {
    "type" : "WEB",
    "url" : "https://cna.openjsf.org/security-advisories.html"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nodejs/undici"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/undici/releases/tag/v6.28.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/undici/releases/tag/v7.29.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/undici/releases/tag/v8.10.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-444" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-29T18:22:07Z",
    "nvd_published_at" : "2026-09-04T18:17:50Z"
  }
}