Undici allows duplicate HTTP Content‑Length headers when headers are provided as a flat array with case‑variant names (e.g., Content‑Length and content-length). This creates malformed HTTP/1.1 requests with two conflicting Content‑Length values sent over the wire, enabling denial of service in strict parsers and opening the possibility for HTTP request smuggling. The weakness is a form of improper header validation and falls under CWE‑444.

Affecting the Node.js HTTP client library undici (undici:undici). Applications that use undici.request(), undici.Client, or other low‑level APIs in which headers are supplied as arrays are impacted. Products that accept user‑controlled header names without first normalizing case and removing duplicates are also at risk. No specific affected versions are listed in the CNA data.

The CVSS base score is 6.5 (moderate) and EPSS is less than 1%, indicating a relatively low likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog. Exploitability is inferred to require an attacker who can influence the headers sent to undici, such as through an application that forwards user input to the library without sanitization. If successfully leveraged, it can cause denial of service or enable request smuggling attacks such as ACL bypass, cache poisoning, or credential hijacking.