Undici’s retry interceptor can append a ranged retry response body to bytes already delivered from a partial response, causing the total body to exceed the Content‑Length header. If an application forwards such a response through a framing‑sensitive path without normalizing the framing, the surplus bytes may be interpreted as the start of a subsequent HTTP response, enabling downstream response splitting, framing desynchronization, or header injection. This weakness is classified as CWE‑444.

All undici library releases older than 6.28.1, all releases from 7.0.0 through 7.29.1, and all releases from 8.0.0 through 8.10.2 are vulnerable. Any application that depends on these undici versions and forwards responses via a framing‑sensitive path is affected.

The CVSS score is only 3.7, indicating a low overall severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker‑controlled upstream server that sends a ranged retry response after a partial body, and an application that forwards the response to downstream peers without proper framing checks—a non‑trivial scenario. Once achieved, an attacker can cause downstream response splitting or framing desynchronization, potentially leading to injection or authentication bypass.