What is CVE-2026-16728?
CVE-2026-16728 is a critical vulnerability in undici's retry interceptor where a response body length may not match the Content-Length header after a retry or resume. This can lead to incorrect data handling in applications using affected versions. Upgrade to undici 6.28.0, 7.29.0, or 8.9.0 to mitigate the issue.
Azərbaycanca: CVE-2026-16728 undici kitabxanasında retry interceptor ilə bağlı kritik boşluqdur. Bədən uzunluğu Content-Length başlığına uyğun gəlməyən cavab təqdim edilə bilər ki, bu da tətbiqetmədə məlumatların yanlış emalına səbəb olur. undici-ni 6.28.0, 7.29.0 və ya 8.9.0 versiyalarına yüksəltmək tövsiyə olunur.
FAQ2
In which library was CVE-2026-16728 discovered and what causes it?
The vulnerability was discovered in the undici library's retry interceptor. The cause is that after a retry or resume operation, the response body length may not match the value specified in the Content-Length header.
To which versions should undici be upgraded to mitigate CVE-2026-16728?
To mitigate this vulnerability, it is recommended to upgrade the undici library to versions 6.28.0, 7.29.0, or 8.9.0.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.