From 866083c80c5a5345192930985080ccc5d0ec8fdf Mon Sep 17 00:00:00 2001
From: Anne van Kesteren <annevk@annevk.nl>
Date: Wed, 14 Jan 2026 08:25:38 +0100
Subject: [PATCH] Block 416 alongside 206

While it is less likely you can attack a 416, it's probably good to stay consistent.
---
 fetch.bs | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/fetch.bs b/fetch.bs
index 8f27d0963..0926ff634 100755
--- a/fetch.bs
+++ b/fetch.bs
@@ -1465,6 +1465,8 @@ worked on in <a href=https://github.com/whatwg/fetch/issues/1156>issue #1156</a>
 
 <p>An <dfn export>ok status</dfn> is a <a for=/>status</a> in the range 200 to 299, inclusive.
 
+<p>A <dfn export>range status</dfn> is a <a for=/>status</a> that is 206 or 416.
+
 <p>A <dfn export>redirect status</dfn> is a <a for=/>status</a> that is 301, 302, 303, 307, or 308.
 
 
@@ -5017,15 +5019,16 @@ steps:
 
  <li>
   <p>If <var>response</var>'s <a for=response>type</a> is "<code>opaque</code>",
-  <var>internalResponse</var>'s <a for=response>status</a> is 206, <var>internalResponse</var>'s
-  <a for=response>range-requested flag</a> is set, and <var>request</var>'s
-  <a for=request>header list</a> <a for="header list">does not contain</a> `<code>Range</code>`,
-  then set <var>response</var> and <var>internalResponse</var> to a <a>network error</a>.
+  <var>internalResponse</var>'s <a for=response>status</a> is a <a>range status</a>,
+  <var>internalResponse</var>'s <a for=response>range-requested flag</a> is set, and
+  <var>request</var>'s <a for=request>header list</a> <a for="header list">does not contain</a>
+  `<code>Range</code>`, then set <var>response</var> and <var>internalResponse</var> to a
+  <a>network error</a>.
 
   <div class=note>
    <p>Traditionally, APIs accept a ranged response even if a range was not requested. This prevents
-   a partial response from an earlier ranged request being provided to an API that did not make a
-   range request.
+   a partial response or a range not satisfiable response from an earlier ranged request being
+   provided to an API that did not make a range request.
 
    <details>
     <summary>Further details</summary>
@@ -10328,6 +10331,7 @@ Wayne Carr,
 Xabier Rodríguez,
 Yehuda Katz,
 Yoav Weiss,
+Yoshisato Yanagisawa<!-- yoshisatoyanagisawa; GitHub -->,
 Youenn Fablet<!-- youennf; GitHub -->,
 Yoichi Osato,
 平野裕 (Yutaka Hirano), and