CVE-2026-18540

Executive Summary

CVE-2026-18540 is an HTTP response desynchronization vulnerability in undici, Node.js's official HTTP/1.1 client library. When undici's retry interceptor handles a ranged retry against a malicious or compromised upstream server that lacks a trustworthy resume checkpoint, it can concatenate bytes from an earlier partial response with bytes from the resumed range response, producing a body that exceeds the Content-Length header the application observes. Applications that relay this response to a downstream HTTP/1.1 peer without renormalizing framing may emit excess bytes that the downstream interprets as the start of the next response, enabling response splitting or desynchronization. All undici versions before 6.28.1, from 7.0.0 through 7.29.1, and from 8.0.0 through 8.10.2 are affected; the CVSS base score is 3.7 (Low), reflecting the high attack complexity and requirement for an attacker-controlled upstream server combined with a framing-sensitive forwarding path.

Technical Analysis

Vulnerability Class

CVE-2026-18540 is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests, commonly termed HTTP Request/Response Smuggling or desynchronization). The defect does not arise from classic header parsing ambiguity but from a framing mismatch introduced by the undici retry interceptor when it processes ranged retry responses.

Mechanism

The NVD description identifies a specific, narrow failure path:

1. Partial delivery without a trustworthy resume checkpoint. An upstream server delivers part of a response body but does not provide a reliable resume position. The description gives two concrete examples:
   • A non-success response whose headers were already sent (i.e., the client received status and headers, but the body was truncated).
   • A partial-content response with an unusable content range (the Content-Range value cannot be trusted as a resume checkpoint).
2. The upstream server then closes the connection, forcing the retry interceptor to issue a resumed range request.
3. The upstream server answers the resumed range request with more bytes.
4. The retry interceptor appends the body of the ranged retry response to bytes already delivered from the earlier partial response.
5. The resulting aggregated body is presented to the application while still carrying the original response's status and headers — critically, the original Content-Length.

The net effect is a body longer than the Content-Length the application observes. The client library has lost framing integrity because it merged two body segments without reconciling the declared length.

Attack Surface and Framing-Sensitive Relay

The vulnerability is only exploitable when two conditions coexist:

• Attacker control of the upstream server returning the crafted partial/resumed responses.
• An application that forwards the response downstream through a path that does not normalize HTTP/1.1 framing. Examples at the class level include reverse-proxy-style relays, response-echoing APIs, and any intermediary that recomputes or reuses Content-Length without re-validating the actual byte count.

When such a relay emits a body exceeding the forwarded Content-Length, the downstream HTTP/1.1 peer treats the excess bytes as the beginning of the following response. This is the desynchronization primitive: a downstream consumer can be made to interpret attacker-influenced bytes as a new response object.

Scope of Affected Versions

Per the NVD description, the following ranges are affected:

• undici < 6.28.1
• undici 7.0.0 up to 7.29.1
• undici 8.0.0 up to 8.10.2

The patched releases are 6.28.1, 7.29.1, and 8.10.2. Patch confidence is rated 4/4 (confirmed by NVD, OSV, and RHSA — three independent sources).

Why CVSS Is 3.7

The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N encodes:

• AV:N (Network) — the attack is delivered over the network via an HTTP upstream.
• AC:H (High) — exploitation demands a specific chain: attacker-controlled upstream, a truncated/unresumable partial response, and a downstream framing-sensitive relay.
• PR:N / UI:N — no privileges or user interaction required in the vulnerable component itself.
• S:U (Unchanged) — impact remains within the vulnerable component's authority.
• C:N (None) — no direct confidentiality impact.
• I:L (Low) — limited integrity impact from response splitting/desynchronization.
• A:N (None) — no direct availability impact.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-18540. The attack chain below is inferred from the vulnerability class (CWE-444) and the mechanism described by NVD; no specific code patterns, function names, or endpoints are asserted beyond those in the source description.

Step 1 — Reconnaissance / Target Identification

An attacker identifies a target application that:

• Uses an affected undici version as its HTTP client.
• Pulls data from an upstream origin the attacker controls or can compromise.
• Relays that upstream response to a downstream HTTP/1.1 peer without normalizing framing (this is the critical, framing-sensitive forwarding path the description calls out).

This combination — attacker-influenced upstream plus a non-normalizing relay — is the reconnaissance filter.

Step 2 — Triggering the Flaw Class

The attacker-controlled upstream server orchestrates the sequence the retry interceptor mishandles:

1. Begin sending a response body — either a non-success response whose headers were already sent or a partial-content response with an unusable content range.
2. Send only part of the body, providing no trustworthy resume checkpoint.
3. Close the connection to force undici's retry interceptor to issue a resumed range request.
4. Answer the resumed range request with additional bytes.

Per the description, the interceptor then appends the retry bytes to the already-delivered bytes while preserving the original status and headers — yielding a body that exceeds the observed Content-Length.

Step 3 — Framing Manipulation and Payload Delivery

The "payload" is not a code-execution blobs; it is framing-influencing bytes. Because the relay forwards the oversized body under the original Content-Length, the excess bytes are interpreted by the downstream peer as the start of a following response. The attacker chooses the trailing bytes so the downstream parser begins a new response boundary at an attacker-controlled offset. This is the response-splitting / desynchronization primitive of CWE-444.

Step 4 — Post-Exploitation Impact

Given the CVSS integrity-only, low-severity scoring and the absence of confidentiality/availability impact:

• The primary realized impact is response splitting or request/response desynchronization at the downstream peer, potentially causing cache poisoning, response queue confusion, or interpretation of attacker-influenced bytes as a subsequent response.
• Scope is Unchanged — no privilege boundary crossing is claimed by the vector.
• No exploit-in-the-wild, CISA KEV listing, or threat-actor campaign is associated with this CVE as of this report.

Impact Assessment

Business impact: Low-to-moderate for most consumers, but potentially significant for organizations operating proxy/relay infrastructure — API gateways, reverse proxies, and service meshes that forward upstream responses verbatim. Such components are exactly the "framing-sensitive path" the description warns of. If undici is embedded in a relay that does not recompute framing, downstream HTTP/1.1 peers (caches, front-end proxies, application servers) may desynchronize, which historically leads to cache poisoning and response-queue confusion.

Affected systems: Any application or service built on Node.js and using undici within the affected ranges. Because undici underpins Node.js's native fetch implementation, the blast radius extends to services relying on built-in HTTP client behavior, not only those importing undici directly.

Blast radius factors:

• CVSS AC:H and S:U limit the worst case to party-to-the-client integrity impact.
• C:N and A:N indicate no direct data exposure or denial-of-service claim.
• The defining gating condition — attacker-controlled upstream + non-normalizing downstream relay — substantially narrows the population of genuinely exposed deployments.

CVSS subscores referenced: AV:N (network-reachable), AC:H (multi-condition exploitation), PR:N (no auth), UI:N (no interaction), S:U (unchanged scope), C:N / I:L (integrity-limited), A:N — composite base score 3.7 (Low).

EPSS: 0.00239 (15.1st percentile) — indicating a currently low probability of exploitation activity in the wild, consistent with the high-complexity attack path and lack of public PoC.

Detection Guidance

Detection centers on observing framing anomalies at the relay boundary: bodies whose actual byte count exceeds their declared Content-Length, and the characteristic truncated-then-resumed transfer pattern (a closed connection followed by a range request against the same resource). The following rules are provided as starting points and require environment-specific tuning.

Sigma Rule

title: Possible Undici Retry Interceptor Response Framing Anomaly (CVE-2026-18540)
id: 8f2c1a44-5e7b-4d92-9c3a-0a1b2c3d4e5f
status: experimental
description: Detects outbound HTTP relays where a response body length exceeds the declared Content-Length, consistent with undici retry interceptor body concatenation and downstream response desynchronization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18540
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: proxy
detection:
  selection_length_mismatch:
    response_body_bytes|gt: response_content_length
  selection_truncation:
    sc_status: 200
    response_body_truncated: true
  selection_range_retry:
    cs_method: 'GET'
    cs_uri_query|contains: 'Range='
  condition: selection_length_mismatch or (selection_truncation and selection_range_retry)
falsepositives:
  - Streaming or chunked responses mis-tagged with a static Content-Length
  - Proxies that log compressed versus uncompressed body sizes
level: low
tags:
  - attack.initial_access
  - cve.2026.18540
  - cwe.444

YARA Rule

rule CVE_2026_18540_Undici_Range_Retry_Framing
{
    meta:
        description = "Detects HTTP response streams with a Content-Length that is inconsistent with a following resume/range segment, indicative of undici retry interceptor body concatenation (CVE-2026-18540)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18540"
        date = "2026-01-01"
        severity = "low"

    strings:
        $cl      = "Content-Length:"
        $cr      = "Content-Range:"
        $range   = "Range:"
        $partial = "206"
        $http11  = "HTTP/1.1"

    condition:
        uint16(0) == 0x4854 or
        (
            $http11 and $cl and
            ( $cr or $range ) and
            $partial and
            filesize > 128
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18540 Possible Undici Ranged Retry Framing Anomaly"; flow:established,to_client; content:"HTTP/1.1"; content:"Content-Length:"; content:"206"; content:"Content-Range:"; classtype:protocol-command-decode; reference:cve,2026-18540; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18540; metadata:created_at 2026_01_01, affected_product Node.js_Undici; sid:2026185401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.response.status_code == 200 and
    http.response.body.bytes > http.response.headers.content_length and
    event.category == "network" ]
  [ network where network.protocol == "http" and
    http.request.method == "GET" and http.request.headers.Range : "*" and
    http.response.status_code == 206 and
    event.category == "network" ]

Splunk SPL Query

index=proxy OR index=network sourcetype=http:*
| eval body_bytes=tonumber(coalesce(response_body_bytes, body_bytes))
| eval declared_len=tonumber(coalesce(content_length, response_content_length))
| where isnotnull(body_bytes) AND isnotnull(declared_len) AND body_bytes > declared_len
| stats count values(uri) as uris values(dest) as destinations by src, dest
| where count > 0
| table _time, src, dest, uris, destinations, count

Wazuh OSSEC Rule

<group name="web,http,cve-2026-18540,">
  <rule id="2026185" level="4">
    <decoded_as>json</decoded_as>
    <field name="http.response.body.bytes">\.+</field>
    <description>CVE-2026-18540: HTTP response body exceeds declared Content-Length - possible undici ranged retry framing anomaly</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 4/4 (CONFIRMED — NVD, OSV, and RHSA independently confirm the fix).

1) Immediate Mitigations

• Upgrade undici as the primary action (see below). There is no separate workaround documented (Workarounds: N/A).
• Where immediate upgrade is not feasible, enforce framing normalization at the relay boundary: any intermediary that forwards upstream responses must recompute or strictly validate Content-Length/body-length consistency before passing the response downstream. This directly targets the condition the CVE description names — relaying without normalizing framing.
• Reject or re-fetch responses lacking a trustworthy resume checkpoint. Treat partial-content responses with unusable content ranges as non-resumable and discard the partial bytes rather than allowing concatenation with a retry response.
• Reduce trust in upstream origins that are attacker-controllable; pin and validate upstream peers where architecture permits.

2) Patch / Upgrade Steps

Per the NVD remediation guidance and confirmed patch sources:

# If pinned to the 6.x line
npm install undici@6.28.1

# If on the 7.x line
npm install undici@7.29.1

# If on the 8.x line
npm install undici@8.10.2

• Verify resolved dependency versions with npm ls undici or npm audit.
• Because undici backs Node.js's built-in fetch, update the runtime's bundled undici where applicable (Node.js releases that vendor the fixed undici versions), not only the application-level dependency.
• Redeploy and, if the relay touched downstream caches, purge potentially poisoned cache entries as a precaution.

3) Long-Term Hardening

• Mandate framing consistency checks in relay/proxy code: never derive Content-Length from an upstream header without validating the emitted body length.
• Adopt HTTP/2 or HTTP/3 for internal relay paths where possible, removing the HTTP/1.1 framing ambiguity that underpins CWE-444 desynchronization.
• Maintain a software bill of materials (SBOM) covering transitive HTTP client libraries, and subscribe to Node.js/undici security advisories.
• Add the detection rules above to CI/CD and runtime monitoring to catch framing anomalies introduced by future client-library regressions.

References

1. NVD — CVE-2026-18540: https://nvd.nist.gov/vuln/detail/CVE-2026-18540
2. OSV — Open Source Vulnerability entry for undici (packages 1cfe0949053aac6267f11b919cee9315a27f1fd6, d7fbba51772deecb830a297647456a5e9f9fec57): https://osv.dev/
3. Red Hat Security Advisory (RHSA) — undici remediation, 6.28.1 / 7.29.1 / 8.10.2: https://access.redhat.com/security/
4. CWE-444 — Inconsistent Interpretation of HTTP Requests: https://cwe.mitre.org/data/definitions/444.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-wild evidence / threat actor campaigns: None reported. CISA KEV: NO. EPSS: 0.00239 (15.1st percentile). No public PoC, exploit code, or Nuclei template currently exists for CVE-2026-18540.