Loading vulnerability…
HTTP Request Smuggling via Duplicate Content-Length Headers in Undici
CVE-2026-1525 is an HTTP request smuggling vulnerability in the Undici HTTP client library. When headers are supplied as flat arrays to undici.request(), undici.Client, or similar low-level APIs, case-variant Content-Length names can bypass duplicate-header checks. Undici consequently emits malformed HTTP/1.1 requests containing multiple conflicting Content-Length values. Strict recipients may reject these requests, while intermediaries and backends that interpret the duplicate values differently may become vulnerable to request smuggling.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malformed requests may be rejected by strict proxies or servers with HTTP 400 responses, disrupting application operations and potentially causing denial of service. Where an intermediary and backend disagree about which Content-Length value determines request boundaries, exploitation may enable HTTP request smuggling, with potential access-control-list bypass, cache poisoning, or credential hijacking. These outcomes depend on application behavior and downstream HTTP parsing.
If you can’t patch tonight, do this now.
Before passing headers to Undici, normalize header names to lowercase and reject duplicate Content-Length headers using case-insensitive comparison. Do not allow user-controlled headers to introduce conflicting request-length values. Prefer passing headers as a plain object rather than a flat array, while retaining explicit normalization and duplicate validation.
Patch, then assume compromise.
Upgrade Undici to version 6.24.0 or later in the 6.x branch, or version 7.24.0 or later in the 7.x branch. For distribution-managed or bundled installations, apply the applicable vendor security updates for Node.js or the containing product. Update affected container images and rebuild dependent images where necessary.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.