The vulnerability in undici's interceptors.retry() allows an attacker or faulty upstream server to cause downstream response desynchronization by delivering a response body whose length does not match the Content-Length header after retrying or resuming partial responses. Specifically, if an upstream returns a 206 Partial Content response with a Content-Length header larger than the actual bytes sent, undici may retry the request and deliver a correctly sized body but with the stale, larger Content-Length header. This can cause downstream proxies or clients that forward or rely on this header to experience connection hangs or response corruption. The vulnerability requires the retry interceptor to be enabled, an upstream that returns mismatched framing headers, and a downstream forwarder that does not recalculate or remove Content-Length. The issue is tracked as CVE-2026-16728 and CWE-444 (Improper Resource Shutdown or Release).

Applications using undici with interceptors.retry() enabled and forwarding upstream response headers and bodies downstream may emit invalid HTTP responses with stale Content-Length headers. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata. The vulnerability does not allow direct code execution or data disclosure but can disrupt HTTP communication reliability and integrity.

A fix is available in undici versions 6.28.0, 7.29.0, and 8.9.0 and later; users should upgrade to these versions or newer. As workarounds, disable interceptors.retry() when dealing with untrusted upstream servers, or ensure that Content-Length headers are removed or recalculated before forwarding responses assembled or transformed by undici.