undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application a…

CVE-2026-16728 affects multiple packages. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. See references for individual vulnerability details.

Source: OSV