Duplicate HTTP Content-Length Headers in Undici from Node.js

CVE-2026-1525

What is CVE-2026-1525?

Undici, a popular HTTP client for Node.js, allows for the inclusion of duplicate HTTP Content-Length headers when headers are passed as an array with case-variant names. This results in malformed HTTP/1.1 requests which can be interpreted inconsistently by servers and intermediaries. Applications that utilize undici.request() or similar low-level APIs are at risk, particularly if they accept user-controlled header names without proper case normalization. The potential consequences include denial of service due to rejections from strict HTTP parsers and exploitation through request smuggling attacks, where conflicting interpretations of the headers can lead to access control bypasses and cache poisoning.

References