Skip to content
Fencer Vulns
medium 6.5

CVE-2026-1525 json

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

published 2026-03-12 7 mo ago modified 2026-09-10 1 mo ago also GHSA-2mjp-6q6p-2qxm , EUVD-2026-11685

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization

Potential consequences:

* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Patch / fix

  • npm undici 6.24.0, 7.24.0
  • undici undici 6.24.0: 7.24.0
  • node-undici Debian 14 7.24.5+dfsg+~cs3.2.0-1

debian advisories DEBIAN-CVE-2026-1525

  • nodejs24 RHEL 10.1 1:24.14.1-2.el10_1
  • nodejs24-npm RHEL 10.1 1:11.11.0-1.24.14.1.2.el10_1
  • nodejs24-libs RHEL 10.1 1:24.14.1-2.el10_1
  • nodejs24-full-i18n RHEL 10.1 1:24.14.1-2.el10_1
  • npm RHEL 8 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
  • nodejs RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75
  • nodejs-libs RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75
  • nodejs-nodemon RHEL 8 3.0.3-1.module+el8.10.0+24190+49a46c75

red hat advisories RHSA-2026:7983RHSA-2026:7675RHSA-2026:7670RHSA-2026:7350RHSA-2026:7310RHSA-2026:7302

  • npm AlmaLinux 8 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
  • nodejs AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-libs AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-nodemon AlmaLinux 8 3.0.3-1.module_el8.10.0+4061+f8ceeab9
  • nodejs-full-i18n AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4086+70facd4a
  • nodejs24-npm AlmaLinux 10 1:11.11.0-1.24.14.1.2.el10_1

almalinux advisories ALSA-2026:7670ALSA-2026:7675ALSA-2026:7350ALSA-2026:7123

  • nodejs24 Rocky Linux 10 1:24.14.1-2.el10_1
  • nodejs-nodemon Rocky Linux 8 3.0.3-1.module+el8.10.0+2084+ab509703
  • nodejs-packaging Rocky Linux 8 2021.06-6.module+el8.10.0+40048+6d99f608
  • nodejs22 Rocky Linux 10 1:22.22.2-1.el10_1
  • nodejs-nodemon Rocky Linux 9 3.0.3-3.module+el9.7.0+40025+0e0cf6b2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40017+f0db1785
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40018+a011993d

rocky linux advisories RLSA-2026:7675RLSA-2026:7670RLSA-2026:7080RLSA-2026:7350RLSA-2026:7302RLSA-2026:7123

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-1525 updated cvss 7.3

undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers

  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8
    affected: workaround, no fix available
  • Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform Expansion Pack org.keycloak-keycloak-parent Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8 Red Hat OpenShift Dev Spaces devspaces/code-sshd-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-9, cryostat/cryostat-openshift-console-plugin-rhel9 4.2.0-9
    fixed: vendor fix RHSA-2026:17789
  • Red Hat Developer Hub 1.8 rhdh 1776784286
    fixed: vendor fix RHSA-2026:9742
  • Red Hat Developer Hub 1.9 rhdh 1777903262
    fixed: vendor fix RHSA-2026:13826
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-libs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs-libs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-nodemon 3.0.1-1.module+el8.10.0+24148+847b6786, nodejs-nodemon 3.0.3-1.module+el8.10.0+24190+49a46c75, +8 more
    fixed: vendor fix RHSA-2026:7123
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-libs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs-libs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-nodemon 3.0.1-1.module+el9.7.0+24157+8ddb2461, nodejs-nodemon 3.0.3-3.module+el9.7.0+24166+51c9666b, +8 more
    fixed: vendor fix RHSA-2026:7302
show 9 more
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.22.2-1.el10_1, nodejs22 22.22.2-1.el10_1, nodejs24 24.14.1-2.el10_1, nodejs-libs 22.22.2-1.el10_1, nodejs24-libs 24.14.1-2.el10_1, nodejs-full-i18n 22.22.2-1.el10_1, +3 more
    fixed: vendor fix RHSA-2026:7080
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.22.2-2.el10_0, nodejs22 22.22.2-2.el10_0, nodejs-libs 22.22.2-2.el10_0, nodejs-full-i18n 22.22.2-2.el10_0, nodejs-npm 10.9.7-1.22.22.2.2.el10_0
    fixed: vendor fix RHSA-2026:7310
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-libs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-nodemon 3.0.1-1.module+el9.6.0+23473+45664c2d, npm 10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e, nodejs-full-i18n 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-packaging 2021.06-4.module+el9.6.0+23473+45664c2d, +1 more
    fixed: vendor fix RHSA-2026:7983
  • Red Hat OpenShift AI 3.3 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1790013905
    fixed: vendor fix RHSA-2026:73987
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/code-rhel9 1779814592
    fixed: vendor fix RHSA-2026:21772
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-db-rhel9 4.2.0-13, cryostat/jfr-datasource-rhel9 4.2.0-9, cryostat/cryostat-reports-rhel9 4.2.0-9, cryostat/cryostat-storage-rhel9 4.2.0-13, cryostat/cryostat-operator-bundle 4.2.0-7, cryostat/cryostat-rhel9-operator 4.2.0-13, +2 more Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat Developer Hub 1.8 rhdh 1776783947, rhdh 1776787729 Red Hat Developer Hub 1.9 rhdh 1777902709, rhdh 1777909942
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9, +11 more
    not affected: component not present
  • Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1790070206, rhoai/rhai-cli-rhel9 1790070206, rhoai/odh-mlflow-rhel9 1789653606, rhoai/odh-trainer-rhel9 1790136369, rhoai/odh-maas-api-rhel9 1790131842, rhoai/odh-mlserver-rhel9 1789121365, +76 more Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1786708633, odf4/ocs-operator-bundle 1786708778, odf4/odf-operator-bundle 1786709119, odf4/cephcsi-operator-bundle 1786708508, odf4/odr-hub-operator-bundle 1786709184, odf4/rook-ceph-operator-bundle 1786709254, +7 more Red Hat OpenShift Dev Spaces devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces 3.28 devspaces/udi-rhel9 1779829736, devspaces/server-rhel9 1779342423, devspaces/openvsx-rhel9 1779528224, devspaces/traefik-rhel9 1779786779, devspaces/udi-base-rhel9 1779741066, devspaces/code-sshd-rhel9 1779813519, +9 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm undici
<6.24.0
>=7.0.0, <7.24.0
6.24.0
7.24.0

Affected products

  • undici undici

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.