CVE-2026-1525

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Published Mar 12, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
* Applications that accept user-controlled header names without case-normalization

Potential consequences:

* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
* HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Analysis

Technical impact

Undici allows duplicate HTTP Content‑Length headers when headers are provided as a flat array with case‑variant names (e.g., Content‑Length and content-length). This creates malformed HTTP/1.1 requests with two conflicting Content‑Length values sent over the wire, enabling denial of service in strict parsers and opening the possibility for HTTP request smuggling. The weakness is a form of improper header validation and falls under CWE‑444.

Affected Systems

Affecting the Node.js HTTP client library undici (undici:undici). Applications that use undici.request(), undici.Client, or other low‑level APIs in which headers are supplied as arrays are impacted. Products that accept user‑controlled header names without first normalizing case and removing duplicates are also at risk. No specific affected versions are listed in the CNA data.

Risk and Exploitability

The CVSS base score is 6.5 (moderate) and EPSS is less than 1%, indicating a relatively low likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog. Exploitability is inferred to require an attacker who can influence the headers sent to undici, such as through an application that forwards user input to the library without sanitization. If successfully leveraged, it can cause denial of service or enable request smuggling attacks such as ACL bypass, cache poisoning, or credential hijacking.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

undici

unaffected

Version	Status	Constraints
`< 6.24.0; 7.0.0 < 7.24.0`	affected	—
`6.24.0: 7.24.0`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:nodejs:undici::::::node.js::*
	cpe:2.3:a:nodejs:undici::::::node.js::*

No data.

Vendor Product Versions

Undici

Version	Status	Scheme	Platform
`[0,6.24.0), [7.0.0,7.24.0)`	affected	semver	—
`[6.24.0,7.24.0]`	unaffected	semver	—

Remediation

Vendor Workaround

If upgrading is not immediately possible: * Validate header names: Ensure no duplicate Content-Length headers (case-insensitive) are present before passing headers to undici * Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key * Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates

OpenCVE Recommended Actions

Validate header names and reject duplicate Content‑Length headers before passing them to undici.
Pass headers as a plain object (e.g., { 'content-length': '123' }) rather than an array to automatically eliminate duplicate keys.
Sanitize user‑controlled header input by normalizing header names to lowercase and rejecting any duplicates.
Check for and install any undici updates that address this issue as they become released.
Monitor undici security advisories and NVD for new patches or mitigations.

Generated by OpenCVE AI on March 19, 2026 at 18:27 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-2mjp-6q6p-2qxm	Undici has an HTTP Request/Response Smuggling issue

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.560% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://cna.openjsf.org/security-advisories.html
https://cwe.mitre.org/data/definitions/444.html
https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm
https://hackerone.com/reports/3556037
https://nvd.nist.gov/vuln/detail/CVE-2026-1525
https://www.cve.org/CVERecord?id=CVE-2026-1525
https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6

History

Mar 19, 2026 5:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Nodejs Nodejs undici
CPEs		cpe:2.3:a:nodejs:undici::::::node.js::*
Vendors & Products		Nodejs Nodejs undici

Mar 13, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Undici Undici undici
Vendors & Products		Undici Undici undici

Mar 13, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-1525 https://www.cve.org/CVERecord?id=CVE-2026-1525
Metrics	threat_severity `None`	threat_severity `Moderate`

Mar 12, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 12, 2026 8:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Title		undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Weaknesses		CWE-444
References		https://cna.openjsf.org/security-advisories.html https://cwe.mitre.org/data/definitions/444.html https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm https://hackerone.com/reports/3556037 https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}`