CVE-2026-18540: 
Grafana vulnerability analysis and mitigation

CVE-2026-18540 is a downstream response splitting vulnerability in the Node.js HTTP client library undici, caused by improper handling in its retry interceptor (interceptors.retry()). When an upstream server delivers a partial response body and then closes the connection, undici's retry logic can resume the request and append the additional bytes to the already-delivered partial body, while still presenting the original response's status and headers (including the original Content-Length). This can cause proxy or gateway applications forwarding the response to emit a body exceeding the declared Content-Length, with excess bytes being interpreted as a subsequent HTTP response — enabling downstream response splitting or desynchronization. Affected versions are undici before 6.28.1, 7.0.0 up to 7.29.1, and 8.0.0 up to 8.10.2. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests — HTTP Request/Response Smuggling). The vulnerability lies in undici's interceptors.retry() mechanism: when an upstream server sends a partial response body (e.g., a 404 with Content-Length: 2 that delivers only one byte before closing), undici resumes the request using a ranged (Range:) retry. The resumed 206 Partial Content bytes are appended to the already-delivered bytes, but the application still observes the original status code and Content-Length header. If the consuming application is a proxy or gateway that forwards undici's status, headers, and body downstream without recalculating framing, the forwarded response body can exceed the declared Content-Length, and the excess bytes may be parsed by a downstream HTTP/1.1 client as the beginning of a new response. Exploitation requires: (1) interceptors.retry() enabled, (2) an attacker-controlled or faulty upstream server, and (3) a downstream forwarder that does not recalculate Content-Length (GitHub Advisory).

Successful exploitation enables downstream HTTP response splitting or desynchronization, where excess bytes appended to a forwarded response body are interpreted by a downstream HTTP/1.1 client as the start of a subsequent response. This primarily affects integrity (CVSS integrity impact: Low), as an attacker could potentially inject crafted HTTP response content into a downstream client's response stream, enabling cache poisoning, session hijacking, or cross-site scripting in proxy/gateway scenarios. Confidentiality and availability are not directly impacted. The attack surface is limited to applications using undici as an HTTP intermediary (proxy, gateway, or relay) with retry logic enabled against untrusted upstreams (GitHub Advisory).

As of the disclosure date (September 4, 2026), there is no known in-the-wild exploitation and no public proof-of-concept exploit code. The EPSS score is 0.0, and the NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity — specifically, an attacker-controlled upstream server and a vulnerable proxy/gateway application using undici's retry interceptor — making opportunistic mass exploitation unlikely (GitHub Advisory).

1. Set up attacker-controlled upstream server: Deploy an HTTP server that responds to initial requests with a partial body (e.g., a 404 response with Content-Length: 2 that sends only 1 byte) and then closes the connection prematurely.
2. Trigger undici retry: Ensure the target application uses undici with interceptors.retry() enabled and is configured to forward requests to the attacker-controlled upstream. The premature connection close triggers undici's retry logic.
3. Serve crafted ranged response: When undici retries with a Range: request to resume the partial body, respond with a 206 Partial Content response containing crafted bytes — including a smuggled HTTP response (e.g., HTTP/1.1 200 OK\r\nContent-Length: X\r\n\r\n<malicious body>).
4. Exploit downstream desynchronization: The target proxy/gateway forwards the response with the original Content-Length: 2 header but a body containing the original byte plus the crafted smuggled bytes. A downstream HTTP/1.1 client interprets the excess bytes as a new HTTP response, enabling response injection, cache poisoning, or session hijacking (GitHub Advisory).

• Network: Unexpected HTTP responses from upstream servers with premature connection closes followed by 206 Partial Content responses to Range: requests; downstream clients receiving malformed or unexpected HTTP responses from a proxy using undici.
• Logs: Application logs showing retry attempts (interceptors.retry()) against upstream servers with non-standard partial responses; downstream HTTP parsing errors or unexpected response boundaries in client-side logs.
• Application Behavior: Downstream HTTP/1.1 clients reporting unexpected response content, mismatched Content-Length values, or apparent receipt of unsolicited HTTP responses following a legitimate request.

Upgrade to one of the patched versions: undici 6.28.1, 7.29.1, or 8.10.2. If an immediate upgrade is not possible, apply one of the following workarounds: (1) Disable interceptors.retry() for untrusted or externally-controlled upstreams, or set maxRetries: 0; (2) Remove or recalculate the Content-Length header before forwarding any response body assembled by undici to downstream clients. Applications that do not act as HTTP proxies or gateways are at significantly lower risk (GitHub Advisory).

The advisory was published by mcollina (a core Node.js maintainer) on September 4, 2026, with remediation review by UlisesGascon and the vulnerability reported via HackerOne by samuel871211 (reports #3900615 and #3900104). No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).