CVE-2026-1525: undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Impact
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted: - Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays - Applications that accept user-controlled header names without case-normalization
Potential consequences: - Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) - HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Workarounds
If upgrading is not immediately possible:
1. Validate header names: Ensure no duplicate Content-Length headers (case-insensitive) are present before passing headers to undici 2. Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key 3. Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates
Other sources
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays Applications that accept user-controlled header names without case-normalization
Potential consequences:
Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.24.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.24.0 - Configuration
If headers may come from user input or are built programmatically, pass headers as a plain object so keys deduplicate by name instead of passing them as flat arrays that can allow case-variant duplicate Content-Length headers.
undici.request()/undici.Client (headers handling) headers format = Use a plain object (e.g., { 'content-length': '123' }) rather than a flat array - Configuration
Before calling undici low-level APIs, normalize header names to lowercase and ensure no duplicate Content-Length headers exist (case-insensitive).
undici.request()/undici.Client (headers handling) Header normalization & duplicates = Normalize header names to lowercase and reject duplicates (case-insensitive) for Content-Length - Compensating control
If an intermediary/proxy/backend is in the path, ensure it rejects requests with duplicate Content-Length headers (e.g., strict parsing that returns 400 Bad Request) to reduce HTTP request smuggling risk from inconsistent duplicate-header interpretation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1525?
The severity of CVE-2026-1525 is classified as medium due to the potential for HTTP request smuggling attacks.
How do I fix CVE-2026-1525?
To fix CVE-2026-1525, update the undici library to the latest version that addresses this vulnerability.
What is the impact of CVE-2026-1525 on web applications?
CVE-2026-1525 can allow an attacker to smuggle HTTP requests, which may lead to unauthorized actions or data exposure.
Which versions of undici are affected by CVE-2026-1525?
All versions of undici prior to the patched version that resolves CVE-2026-1525 are affected.
Is authentication required to exploit CVE-2026-1525?
No, CVE-2026-1525 can be exploited without authentication, making it a critical security concern.