CLEANSTART-2026-CJ83222 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response

🗓️ 29 Sep 2026 00:39:59Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Undici's retry interceptor in langfuse causes body length to mismatch Content-Length.

Reporter	Title	Published	Views	Family All 196
IBM Security Bulletins	Security Bulletin: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher	9 Sep 202620:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697.	7 Sep 202605:22	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance	8 Sep 202617:18	–	ibm
attackerkb	CVE-2026-16728	29 Jul 202620:59	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)	18 Aug 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)	18 Aug 202600:00	–	nessus
Tenable Nessus	SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2026:4248-1)	18 Sep 202600:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : nodejs18 (SUSE-SU-2026:4261-1)	19 Sep 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-16728	30 Jul 202600:00	–	nessus
Amazon	Important: nodejs24	17 Aug 202600:00	–	amazon

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CJ83222.json
osv	www.osv.dev/vulnerability/CVE-2026-16728
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-16728

29 Sep 2026 00:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.00176

langfuse undici retry interceptor Content-Length response body mismatch