CVE-2026-1525

Published: Mar 12, 2026 Last Modified: Mar 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: ce714d77-add3-4f53-aff5-83d477b104bb
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low

Description

AI Translation Available

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
* Applications that accept user-controlled header names without case-normalization

Potential consequences:

* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
* HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Incomplete
Common Consequences
Security Scopes Affected:
Integrity Non-Repudiation Access Control
Potential Impacts:
Unexpected State Hide Activities Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
https://cna.openjsf.org/security-advisories.html
https://cwe.mitre.org/data/definitions/444.html
https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm
https://hackerone.com/reports/3556037
https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6