Undici versions prior to 6.28.0, 7.29.0, and 8.9.0 contain a vulnerability in the interceptors.retry() feature where the response body length may not match the Content-Length header after retrying or resuming a partial response. This mismatch can cause downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the Content-Length header for framing. The issue arises when an upstream server returns a partial content response with incorrect Content-Length, and the retry interceptor retries the request, resulting in a stale Content-Length header being forwarded. The vulnerability is patched in undici versions 6.28.0, 7.29.0, and 8.9.0 and later.