CVE-2026-1525
published 2026-03-12CVE-2026-1525: Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.49%
38.9th percentile
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) | node-undici 7.24.5+dfsg+~cs3.2.0-1 (forky) |
| nodejs | undici | < 6.24.0 | 6.24.0 |
| nodejs | undici | >= 7.0.0 < 7.24.0 | 7.24.0 |
| undici | undici | < 6.24.0; 7.0.0 < 7.24.0 | 6.24.0; 7.0.0 < 7.24.0 |
| undici | undici | >= 0 < 6.24.0 | 6.24.0 |
| undici | undici | >= 7.0.0 < 7.24.0 | 7.24.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
vendor_redhat·2026-03-12·CVSS 6.5
CVE-2026-1525 [MEDIUM] CWE-444 undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
* Applications that accept user-controlled header names without case-normalization
Potential consequences:
* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
* HTTP Request Smuggling: In deployments where an intermediary an
Debian
CVE-2026-1525: node-undici - Undici allows duplicate HTTP Content-Length headers when they are provided in an...
vendor_debian·2026·CVSS 6.5
CVE-2026-1525 [MEDIUM] CVE-2026-1525: node-undici - Undici allows duplicate HTTP Content-Length headers when they are provided in an...
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses t
OSV
Undici has an HTTP Request/Response Smuggling issue
osv·2026-03-13
CVE-2026-1525 [MEDIUM] Undici has an HTTP Request/Response Smuggling issue
Undici has an HTTP Request/Response Smuggling issue
### Impact
Undici allows duplicate HTTP `Content-Length` headers when they are provided in an array with case-variant names (e.g., `Content-Length` and `content-length`). This produces malformed HTTP/1.1 requests with multiple conflicting `Content-Length` values on the wire.
**Who is impacted:**
- Applications using `undici.request()`, `undici.Client`, or similar low-level APIs with headers passed as flat arrays
- Applications that accept user-controlled header names without case-normalization
**Potential consequences:**
- **Denial of Service**: Strict HTTP parsers (proxies, servers) will reject requests with duplicate `Content-Length` headers (400 Bad Request)
- **HTTP Request Smuggling**: In deployments where an intermediary and bac
GHSA
Undici has an HTTP Request/Response Smuggling issue
ghsa·2026-03-13
CVE-2026-1525 [MEDIUM] CWE-444 Undici has an HTTP Request/Response Smuggling issue
Undici has an HTTP Request/Response Smuggling issue
### Impact
Undici allows duplicate HTTP `Content-Length` headers when they are provided in an array with case-variant names (e.g., `Content-Length` and `content-length`). This produces malformed HTTP/1.1 requests with multiple conflicting `Content-Length` values on the wire.
**Who is impacted:**
- Applications using `undici.request()`, `undici.Client`, or similar low-level APIs with headers passed as flat arrays
- Applications that accept user-controlled header names without case-normalization
**Potential consequences:**
- **Denial of Service**: Strict HTTP parsers (proxies, servers) will reject requests with duplicate `Content-Length` headers (400 Bad Request)
- **HTTP Request Smuggling**: In deployments where an intermediary and bac
OSV
CVE-2026-1525: Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e
osv·2026-03-12·CVSS 9.8
CVE-2026-1525 [CRITICAL] CVE-2026-1525: Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses t
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-1525 undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
bugzilla·2026-03-12·CVSS 6.5
CVE-2026-1525 [MEDIUM] CVE-2026-1525 undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
CVE-2026-1525 undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
* Applications that accept user-controlled header names without case-normalization
Potential consequences:
* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
* HTTP Request Smuggling: In deployments where
Bugzilla
CVE-2026-1525 nodejs22: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers [fedora-all]
bugzilla·2026-03-12·CVSS 9.8
CVE-2026-1525 [CRITICAL] CVE-2026-1525 nodejs22: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers [fedora-all]
CVE-2026-1525 nodejs22: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-3b76d8047d (nodejs22-22.22.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3b76d8047d
Bugzilla
CVE-2026-1525 nodejs20: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers [fedora-all]
bugzilla·2026-03-12·CVSS 9.8
CVE-2026-1525 [CRITICAL] CVE-2026-1525 nodejs20: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers [fedora-all]
CVE-2026-1525 nodejs20: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-9dc3a61ad8 (nodejs20-20.20.2-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9dc3a61ad8
---
FEDORA-2026-9dc3a61ad8 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9dc3a61ad8`
You can provide feedback for
Wiz
CVE-2026-1525 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-1525 [MEDIUM] CVE-2026-1525 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1525 :
JavaScript vulnerability analysis and mitigation
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
Applications that accept user-controlled header names without case-normalization
Potential consequences:
Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate heade
2026-03-12
Published