# CVE-2026-18540: undici vulnerable to downstream response splitting via retry interceptor CVE-2026-18540 is fixed in 21 products on 1 platform, first by DEBIAN-CVE-2026-18540, released September 10, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-18540 - Priority: Routine - CVSS: 3.7 (Low) - EPSS: 0.0031 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 4, 2026 - Weakness: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-18540 ## Description undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | node-undici Debian 14 | 8.10.2+dfsg+~cs3.2.2-1 | [DEBIAN-CVE-2026-18540](https://patchblox.com/security/data/fix/linux/debian-cve-2026-18540.md) | Sep 10, 2026 | | Linux | nodejs22 amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-debuginfo amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-debugsource amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-devel amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-docs amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-full-i18n amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-libs amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-libs-debuginfo amzn 2023 | 1:22.23.3-1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs22-npm amzn 2023 | 1:10.9.9-1.22.23.3.1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | nodejs24 amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-debuginfo amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-debugsource amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-devel amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-docs amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-full-i18n amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-libs amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-libs-debuginfo amzn 2023 | 1:24.21.0-1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | nodejs24-npm amzn 2023 | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | | Linux | v8-12.4-devel amzn 2023 | 3:12.4.254.21-1.22.23.3.1.amzn2023.0.1 | [ALAS2023-2026-3277](https://patchblox.com/security/data/fix/linux/alas2023-2026-3277.md) | Nov 7, 2026 | | Linux | v8-13.6-devel amzn 2023 | 3:13.6.233.17-1.24.21.0.1.amzn2023.0.1 | [ALAS2023-2026-3107](https://patchblox.com/security/data/fix/linux/alas2023-2026-3107.md) | Sep 28, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.