{"vulnerability": "cve-2026-16728", "sightings": [{"uuid": "fc4287d8-e140-469f-beed-76f787aaf8f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16728", "type": "seen", "source": "https://gist.github.com/alon710/51c65a255f770cf34523cbf52ef9595a", "content": "# CVE-2026-16728: CVE-2026-16728: Downstream HTTP Response Desynchronization in Undici Retry Interceptor\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-16728\n\n## Summary\nA medium-severity vulnerability in Undici's retry interceptor causes body-length mismatches with the Content-Length header during HTTP 206 response resumption. Forwarding these inconsistent headers downstream leads to HTTP response desynchronization, connection hangs, or potential protocol smuggling.\n\n## TL;DR\nUndici's retry interceptor failed to validate the Content-Length header against actual bytes received when retrying broken HTTP 206 Partial Content responses, creating desynchronization risks in downstream proxies.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.8\n- **EPSS Score**: 0.00164\n- **Impact**: HTTP Response Desynchronization, Client Connection Hangs, Protocol Smuggling\n- **Exploit Status**: poc\n- **Kev Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications using undici library with retry interceptor enabled\n- **undici**: < 6.28.0 (Fixed in: `6.28.0`)\n- **undici**: >= 7.0.0, < 7.29.0 (Fixed in: `7.29.0`)\n- **undici**: >= 8.0.0, < 8.9.0 (Fixed in: `8.9.0`)\n\n## Mitigation\n\n- Upgrade the Undici dependency to a patched version (6.28.0, 7.29.0, or 8.9.0 or higher).\n- Recalculate the Content-Length header in middlebox or reverse-proxy code before forwarding headers downstream.\n- Strip the Content-Length header and utilize chunked transfer encoding (Transfer-Encoding: chunked) for downstream proxy responses.\n\n**Remediation Steps:**\n1. Identify all Node.js projects utilizing the undici library by examining package.json and package-lock.json files.\n2. Update undici to version 6.28.0 (for 6.x), 7.29.0 (for 7.x), or 8.9.0 (for 8.x) using the package manager.\n3. Ensure any proxy or gateway routes do not blindly trust and forward the Content-Length header from upstream servers without validation.\n4. Execute testing suites with test cases that mimic interrupted range responses to verify that connections reject invalid frames appropriately.\n\n## References\n\n- [GitHub Security Advisory GHSA-8xcm-r25x-g524](https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [CVE-2026-16728 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-16728)\n- [NVD - CVE-2026-16728 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-16728)\n- [Fix Commit in Undici Repository](https://github.com/nodejs/undici/commit/1b5a5312c3a7d7a30c31bf0d000b39a8a2531e1c)\n- [Refactor/Abort Commit in Undici Repository](https://github.com/nodejs/undici/commit/cba3a52ac2e7abcc4e656d82af8579ea82c2bb9e)\n- [Test Corrections - Range boundary updates (Commit 1)](https://github.com/nodejs/undici/commit/2b3f749336d356bbbc50192f87f6cf7bc714721a)\n- [Test Corrections - Range boundary updates (Commit 2)](https://github.com/nodejs/undici/commit/4a9dafb16ff43880cf590e6d9c2aeee25fbff6d7)\n- [Test Corrections - Range boundary updates (Commit 3)](https://github.com/nodejs/undici/commit/4fd5a0c61e627f928b7003adc4ffe1e55ec63420)\n- [Undici Release Tag v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0)\n- [Undici Release Tag v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0)\n- [Undici Release Tag v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-16728) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T14:32:21.375709Z"}, {"uuid": "1a810abb-8657-44f7-b920-8b318a5d7dad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16728", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxocasct2i", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-16728 impacts undici in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/645\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:01:00.827683Z"}, {"uuid": "446ceda1-d03f-4680-a3c1-69eed6a85068", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16728", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mrst4zfho22c", "content": "\ud83d\udea8 Medium-severity security fix in undici@6.28.0, 7.29.0, and 8.9.0 just released!\n\nPatches CVE-2026-16728: downstream response desynchronization via retry interceptor\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-07-29T21:02:32.069588Z"}]}