undici does not validate the type field of a duck‑typed blob‑like body before using it as the Content‑Type header when dispatching HTTP/1.1 requests. If an attacker supplies untrusted data that becomes the type value, the library may inject CRLF sequences into the resulting header, allowing arbitrary HTTP headers to be appended. This can lead to HTTP request smuggling, which may be used to tunnel a second request or alter server behaviour. The flaw is identified as CWE‑93.

The vulnerability affects the undici package for JavaScript. Versions before 6.28.0, before 7.29.0, and before 8.9.0 are impacted. Native Blob objects and the standard fetch API are not vulnerable because they sanitize the type field or perform header validation respectively. Ecosystem libraries that build duck‑typed blob shapes from user input can expose the vulnerable path.

The CVSS score of 4.2 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to control the 'type' property of a blob‑like body sent through undici, which typically requires some form of user‑controllable input being rejected or improperly validated by an application. If this condition is satisfied, the attacker could inject CRLF and deliver arbitrary headers, potentially smuggling a second request or manipulating downstream services.