CVE-2026-1525 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Attackers can cause HTTP request smuggling or denial of service by exploiting inconsistent handling of duplicate Content-Length headers in undici.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1525?
CVE-2026-1525 is a medium-severity vulnerability in Nodejs Undici, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization
Potential consequences:
* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Weakness: CWE-444
Which versions are affected by CVE-2026-1525?
4 open source packages ship an affected version, including undici. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
undici npm | All versions | 6.24.0 |
undici npm | All versions | 6.24.0 |
undici npm | From 7.0.0 | 7.24.0 |
undici npm | From 7.0.0 | 7.24.0 |
Products include Nodejs Undici.
How do I fix CVE-2026-1525?
Upgrade undici to a fixed version for your release line: 6.24.0 or 7.24.0.
Is CVE-2026-1525 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1525 exists.
Other vulnerabilities in Nodejs Undici
- CVE-2026-109855 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
- CVE-2026-109869 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- CVE-2026-87018 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
- CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-12151 undici WebSocket client vulnerable to denial of service via fragment count bypass
Sources
Also known as BELL-CVE-2026-1525, CLEANSTART-2026-CC67789, CLEANSTART-2026-NI54084, CLSA-2026-1779065182, DEBIAN-CVE-2026-1525, ECHO-7e19-b46c-b4e1 and 14 more.