CVE-2026-18540 undici CVE debrief

Who should care

Defenders responsible for undici-based applications, particularly those that forward responses through framing-sensitive paths, should assess exposure and prioritize upgrading to undici 6.28.1, 7.29.1, or 8.10.2.

Why it matters

CVE-2026-18540 is a vulnerability in undici that can cause downstream response splitting or desynchronization. Defenders should prioritize upgrading to undici 6.28.1, 7.29.1, or 8.10.2 to mitigate this vulnerability. The vulnerability affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path.

• Potential downstream response splitting or desynchronization
• Possible exploitation by attacker-controlled upstream servers
• Need for verification of affected versions and remediation
• Importance of upgrading to undici 6.28.1, 7.29.1, or 8.10.2

Technical summary

The undici retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response, causing downstream response splitting or desynchronization. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. The vulnerability requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path, allowing for potential downstream response splitting or desynchronization. Defenders should prioritize upgrading to undici 6.28.1, 7.29.1, or 8.10.2 to mitigate this vulnerability.

Defensive priority

Defenders should prioritize upgrading to undici 6.28.1, 7.29.1, or 8.10.2 to mitigate this vulnerability.

Recommended defensive actions

• Upgrade to undici 6.28.1, 7.29.1, or 8.10.2
• Review and update affected applications that forward responses through framing-sensitive paths
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.