fix(retry): validate resumed response framing

Checkpoint the original response framing before exposing headers and reject resumed responses whose Content-Range does not match it. Do not retry after an exposed response without a resumable length, preventing attacker-controlled retry responses from being concatenated into downstream output.

Fixes: GHSA-r53p-7pc4-xj5r
CVE: CVE-2026-18540
Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit a424f8cc8fde7fd12cb1a09f84344335d5e469e6)

Author: mcollina

lib/handler/retry-handler.js

@@ -96,6 +96,7 @@ class RetryHandler {
       // Preserve old behavior for status codes that are not eligible for retry
       if (this.retryOpts.statusCodes.includes(statusCode) === false) {
         this.headersSent = true
+        this.checkpointResponseEnd(headers)
         this.handler.onResponseStart?.(controller, statusCode, headers, statusMessage)
       } else {
         this.error = err
@@ -106,13 +107,15 @@ class RetryHandler {
 
     if (isDisturbed(this.opts.body)) {
       this.headersSent = true
+      this.checkpointResponseEnd(headers)
       this.handler.onResponseStart?.(controller, statusCode, headers, statusMessage)
       return
     }
 
     function shouldRetry (passedErr) {
       if (passedErr) {
         this.headersSent = true
+        this.checkpointResponseEnd(headers)
         this.handler.onResponseStart?.(controller, statusCode, headers, statusMessage)
         controller.resume()
         return
@@ -133,6 +136,20 @@ class RetryHandler {
     )
   }
 
+  checkpointResponseEnd (headers) {
+    if (this.end == null && this.opts.method !== 'HEAD') {
+      const contentLength = headers['content-length']
+      this.end = contentLength != null ? Number(contentLength) - 1 : null
+
+      assert(
+        this.end == null || Number.isFinite(this.end),
+        'invalid content-length'
+      )
+
+      this.resume = this.end != null
+    }
+  }
+
   onRequestStart (controller, context) {
     if (!this.headersSent) {
       this.handler.onRequestStart?.(controller, context)
@@ -253,8 +270,12 @@ class RetryHandler {
 
       const { start, size, end = size ? size - 1 : null } = contentRange
 
-      assert(this.start === start, 'content-range mismatch')
-      assert(this.end == null || this.end === end, 'content-range mismatch')
+      if (this.start !== start || (this.end != null && this.end !== end)) {
+        throw new RequestRetryError('Content-Range mismatch', statusCode, {
+          headers,
+          data: { count: this.retryCount }
+        })
+      }
 
       return
     }
@@ -379,7 +400,7 @@ class RetryHandler {
   }
 
   onResponseError (controller, err) {
-    if (controller?.aborted || isDisturbed(this.opts.body)) {
+    if (controller?.aborted || isDisturbed(this.opts.body) || (this.headersSent && !this.resume)) {
       this.handler.onResponseError?.(controller, err)
       return
     }

test/interceptors/retry.js

@@ -511,6 +511,199 @@ test('Should handle 206 partial content - bad-etag', async t => {
   }
 })
 
+test('#4970 - Should reject resumed partial content when body exceeds Content-Range', async t => {
+  t = tspl(t, { plan: 5 })
+
+  let x = 0
+  const injectedResponse = 'HTTP/1.1 302 Found\r\nLocation: http://evil.com\r\nContent-Length: 0\r\n\r\n'
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
+    if (x === 0) {
+      t.ok(true, 'pass')
+      res.setHeader('content-length', '5')
+      res.setHeader('etag', '123')
+      res.write('use')
+      setTimeout(() => {
+        res.destroy()
+      }, 1e2)
+    } else if (x === 1) {
+      t.deepStrictEqual(req.headers.range, 'bytes=3-4')
+      t.deepStrictEqual(req.headers['if-match'], '123')
+      res.statusCode = 206
+      res.setHeader('etag', '123')
+      res.setHeader('content-range', 'bytes 3-4/5')
+      res.end(`r1${injectedResponse}`)
+    }
+    x++
+  })
+
+  const requestOptions = {
+    method: 'GET',
+    path: '/',
+    headers: {
+      'content-type': 'application/json'
+    },
+    retryOptions: {
+      retry: (err, { state, opts }, done) => {
+        if (err.message.includes('other side closed')) {
+          setTimeout(done, 100)
+          return
+        }
+
+        return done(err)
+      }
+    }
+  }
+
+  server.listen(0)
+
+  await once(server, 'listening')
+
+  const client = new Client(
+    `http://localhost:${server.address().port}`
+  ).compose(retry())
+
+  after(async () => {
+    await client.close()
+    server.close()
+
+    await once(server, 'close')
+  })
+
+  const response = await client.request(requestOptions)
+  t.strictEqual(response.statusCode, 200)
+  await t.rejects(response.body.text(), {
+    name: 'RequestRetryError',
+    code: 'UND_ERR_REQ_RETRY',
+    message: 'Content-Length mismatch'
+  })
+})
+
+test('#3900615 - Should reject a resumed response that exceeds an error response content-length', async t => {
+  t = tspl(t, { plan: 3 })
+
+  let x = 0
+  let retries = 0
+  const injectedResponse = 'HTTP/1.1 302 Found\r\nLocation: http://evil.com\r\nContent-Length: 0\r\n\r\n'
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
+    if (x === 0) {
+      res.statusCode = 404
+      res.setHeader('content-length', '2')
+      res.end('1', () => res.destroy())
+    } else if (x === 1) {
+      t.strictEqual(req.headers.range, 'bytes=1-1')
+      res.statusCode = 206
+      res.setHeader('connection', 'close')
+      res.setHeader('content-range', `bytes 1-${injectedResponse.length + 1}/${injectedResponse.length + 2}`)
+      res.end(`2${injectedResponse}`)
+    }
+    x++
+  })
+
+  server.listen(0)
+
+  await once(server, 'listening')
+
+  const client = new Client(
+    `http://localhost:${server.address().port}`
+  ).compose(retry())
+
+  after(async () => {
+    await client.destroy()
+    server.closeAllConnections()
+    server.close()
+
+    await once(server, 'close')
+  })
+
+  const response = await client.request({
+    method: 'GET',
+    path: '/',
+    retryOptions: {
+      retry: (err, _context, done) => {
+        if (err.message.includes('other side closed') && retries++ === 0) {
+          done(null)
+          return
+        }
+
+        done(err)
+      }
+    }
+  })
+  t.strictEqual(response.statusCode, 404)
+  await t.rejects(response.body.text(), {
+    name: 'RequestRetryError',
+    code: 'UND_ERR_REQ_RETRY',
+    message: 'Content-Range mismatch'
+  })
+})
+
+test('#3900104 - Should not resume a 206 response without a usable content-range', async t => {
+  t = tspl(t, { plan: 4 })
+
+  let x = 0
+  const server = createServer({ joinDuplicateHeaders: true }, (_req, res) => {
+    t.strictEqual(x, 0, 'must not retry an uncheckpointed partial response')
+    res.statusCode = 206
+    res.setHeader('content-length', '2')
+    res.setHeader('content-range', 'bytes 0-999')
+    res.write('1', () => res.destroy())
+    x++
+  })
+
+  server.listen(0)
+
+  await once(server, 'listening')
+
+  const client = new Client(
+    `http://localhost:${server.address().port}`
+  ).compose(retry())
+
+  after(async () => {
+    await client.destroy()
+    server.close()
+
+    await once(server, 'close')
+  })
+
+  const response = await client.request({ method: 'GET', path: '/' })
+  t.strictEqual(response.statusCode, 206)
+  await t.rejects(response.body.text(), {
+    name: 'SocketError',
+    code: 'UND_ERR_SOCKET',
+    message: 'other side closed'
+  })
+  t.strictEqual(x, 1)
+})
+
+test('Should not reject a HEAD response with content-length', async t => {
+  t = tspl(t, { plan: 3 })
+
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
+    res.setHeader('content-length', '1234')
+    res.end()
+  })
+
+  server.listen(0)
+
+  await once(server, 'listening')
+
+  const client = new Client(
+    `http://localhost:${server.address().port}`
+  ).compose(retry())
+
+  after(async () => {
+    await client.close()
+    server.close()
+
+    await once(server, 'close')
+  })
+
+  const response = await client.request({ method: 'HEAD', path: '/' })
+  t.strictEqual(response.statusCode, 200)
+  t.strictEqual(response.headers['content-length'], '1234')
+  t.strictEqual(await response.body.text(), '')
+})
+
 test('retrying a request with a body', async t => {
   t = tspl(t, { plan: 2 })
   let counter = 0