A flaw in undici's retry interceptor can return a response whose body length does not match the Content-Length header after a retry or partial resume. If an application forwards the upstream headers and body downstream without recalculating or removing the stale Content-Length, the downstream client receives an invalid HTTP response, which can lead to connection hangs, data corruption, or other disrupted communication.

The vulnerability affects the undici library published by undici. Versions prior to 6.28.0, from 7.0.0 up to but excluding 7.29.0, and from 8.0.0 up to but excluding 8.9.0 are impacted. Applications that enable the retry interceptor and forward upstream responses, such as reverse proxies or gateways, are at risk.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an upstream server that supplies a partial response with a mismatched framing header, an undici client configured with the retry interceptor, and a downstream forwarder that does not adjust the Content-Length header. If these conditions are met, an attacker can induce downstream connection, loss of data integrity, or corruption.