Undici retry interceptor response desynchronization via stale Content-Length

#!/usr/bin/env bash
# check_cve_2026_16728.sh — Detect CVE-2026-16728 (undici retry interceptor Content-Length desync)
# Usage: bash check_cve_2026_16728.sh [app_directory]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

APP_DIR="${1:-.}"
VULNERABLE=0

version_gte() {
  # Returns 0 if $1 >= $2 using semantic versioning
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

echo "=== CVE-2026-16728 Check ==="
echo

# 1. Check Node.js bundled undici
if command -v node &>/dev/null; then
  NODE_VER=$(node -v | sed 's/^v//')
  BUNDLED_UNDICI=$(node -e "try{console.log(process.versions.undici||'none')}catch(e){console.log('none')}" 2>/dev/null || echo 'none')
  echo "[*] Node.js version: $NODE_VER"
  echo "[*] Bundled undici:  $BUNDLED_UNDICI"
  if [ "$BUNDLED_UNDICI" != "none" ]; then
    MAJOR=$(echo "$BUNDLED_UNDICI" | cut -d. -f1)
    case $MAJOR in
      6) if version_gte "$BUNDLED_UNDICI" "6.28.0"; then echo "    -> Bundled undici PATCHED"; else echo "    -> Bundled undici VULNERABLE"; VULNERABLE=1; fi ;;
      7) if version_gte "$BUNDLED_UNDICI" "7.29.0"; then echo "    -> Bundled undici PATCHED"; else echo "    -> Bundled undici VULNERABLE"; VULNERABLE=1; fi ;;
      8) if version_gte "$BUNDLED_UNDICI" "8.9.0";  then echo "    -> Bundled undici PATCHED"; else echo "    -> Bundled undici VULNERABLE"; VULNERABLE=1; fi ;;
      *) echo "    -> Bundled undici version $MAJOR.x not in affected range"; ;;
    esac
  fi
else
  echo "[!] node not found in PATH"
fi

echo

# 2. Check npm-installed undici in the app directory
if [ -d "$APP_DIR/node_modules/undici" ]; then
  PKG_VER=$(node -e "console.log(require('$APP_DIR/node_modules/undici/package.json').version)" 2>/dev/null || echo 'unknown')
  echo "[*] npm undici in $APP_DIR: $PKG_VER"
  if [ "$PKG_VER" = "unknown" ]; then
    echo "    -> UNKNOWN (could not read version)"
  else
    MAJOR=$(echo "$PKG_VER" | cut -d. -f1)
    case $MAJOR in
      [0-5]) echo "    -> Version $PKG_VER predates affected retry interceptor (likely not vulnerable, but upgrade recommended)"; ;;
      6) if version_gte "$PKG_VER" "6.28.0"; then echo "    -> npm undici PATCHED"; else echo "    -> npm undici VULNERABLE"; VULNERABLE=1; fi ;;
      7) if version_gte "$PKG_VER" "7.29.0"; then echo "    -> npm undici PATCHED"; else echo "    -> npm undici VULNERABLE"; VULNERABLE=1; fi ;;
      8) if version_gte "$PKG_VER" "8.9.0";  then echo "    -> npm undici PATCHED"; else echo "    -> npm undici VULNERABLE"; VULNERABLE=1; fi ;;
      *) echo "    -> Version $MAJOR.x — check advisory for coverage"; ;;
    esac
  fi
else
  echo "[*] No npm-installed undici found in $APP_DIR/node_modules/"
fi

echo

# 3. Check for retry interceptor usage (exposure gate)
echo "[*] Scanning for retry interceptor usage in $APP_DIR ..."
if grep -r -l 'interceptors\.retry\|RetryAgent\|RetryHandler' --include='*.js' --include='*.ts' --include='*.mjs' --include='*.cjs' "$APP_DIR" 2>/dev/null | grep -v node_modules | head -5; then
  echo "    -> RETRY INTERCEPTOR IN USE — this app may be exposed"
else
  echo "    -> No retry interceptor usage found (app likely not exposed even if undici is vulnerable)"
fi

echo
if [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE"
  exit 1
else
  echo "PATCHED"
  exit 0
fi