Threat Intelligence Database

Undici versions prior to 6.28.0, 7.29.0, and 8.9.0 contain a vulnerability in the interceptors.retry() feature where the response body length may not match the Content-Length header after retrying or resuming a partial response. This mismatch can cause downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the Content-Length header for framing. The issue arises when an upstream server returns a partial content response with incorrect Content-Length, and the retry interceptor retries the request, resulting in a stale Content-Length header being forwarded. The vulnerability is patched in undici versions 6.28.0, 7.29.0, and 8.9.0 and later.

n8n versions prior to 2.28.0-r2, including versions from 7.0.0 up to but not including 7.29.0 and 8.0.0 up to but not including 8.9.0, are affected by multiple vulnerabilities including CVE-2026-14643. This vulnerability is classified with moderate severity and relates to security weaknesses identified by CWE-436 and CWE-524. The issue has been addressed in n8n version 2.28.0-r2, which includes fixes for 46 vulnerabilities. No known exploits are reported in the wild at this time.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle