Skip to content

[GHSA-2mjp-6q6p-2qxm] Undici has an HTTP Request/Response Smuggling issue #7514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tijuks wants to merge 2 commits into
base: tijuks/advisory-improvement-7514
Choose a base branch
from
Open

[GHSA-2mjp-6q6p-2qxm] Undici has an HTTP Request/Response Smuggling issue #7514

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b4be125
Improve GHSA-2mjp-6q6p-2qxm
tijuks Apr 28, 2026
f3f9bdb
Improve GHSA-2mjp-6q6p-2qxm
tijuks Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions advisories/github-reviewed/2026/03/GHSA-2mjp-6q6p-2qxm/GHSA-2mjp-6q6p-2qxm.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2mjp-6q6p-2qxm",
"modified": "2026-03-13T20:07:03Z",
"modified": "2026-03-13T20:07:05Z",
"published": "2026-03-13T20:07:03Z",
"aliases": [
"CVE-2026-1525"
],
"summary": "Undici has an HTTP Request/Response Smuggling issue",
"summary": "HTTP Request/Response Smuggling issue",
"details": "### Impact\n\nUndici allows duplicate HTTP `Content-Length` headers when they are provided in an array with case-variant names (e.g., `Content-Length` and `content-length`). This produces malformed HTTP/1.1 requests with multiple conflicting `Content-Length` values on the wire.\n\n**Who is impacted:**\n - Applications using `undici.request()`, `undici.Client`, or similar low-level APIs with headers passed as flat arrays\n - Applications that accept user-controlled header names without case-normalization\n\n**Potential consequences:**\n - **Denial of Service**: Strict HTTP parsers (proxies, servers) will reject requests with duplicate `Content-Length` headers (400 Bad Request)\n - **HTTP Request Smuggling**: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking\n\n### Patches\n\n Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.\n\n### Workarounds\n\n If upgrading is not immediately possible:\n\n 1. **Validate header names**: Ensure no duplicate `Content-Length` headers (case-insensitive) are present before passing headers to undici\n 2. **Use object format**: Pass headers as a plain object (`{ 'content-length': '123' }`) rather than an array, which naturally deduplicates by key\n 3. **Sanitize user input**: If headers originate from user input, normalize header names to lowercase and reject duplicates",
"severity": [
{
Expand Down Expand Up @@ -85,9 +85,7 @@
}
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"cwe_ids": [],
Copy link
Copy Markdown

@mcollina mcollina Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why?

"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2026-03-13T20:07:03Z",
Expand Down
Loading