Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization
Potential consequences:
* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docs | Apr 16, 2026 | Apr 8, 2026 |
| Amazon_linux_2023 | — | Upgrade v8-13.6-develUpgrade nodejs24Upgrade nodejs24-debugsourceUpgrade v8-11.3-develUpgrade nodejs22-full-i18nUpgrade nodejs20-npmUpgrade nodejs22-docsUpgrade nodejs24-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs22Upgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs22-develUpgrade nodejs20-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs22-libsUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs20-full-i18nUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-npmUpgrade nodejs20-docsUpgrade nodejs20Upgrade nodejs20-debugsourceUpgrade nodejs20-libsUpgrade nodejs20-devel | Apr 7, 2026 | Mar 12, 2026 |
| Oracle_linux | — | Upgrade nodejs-npmUpgrade nodejs24-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs24-full-i18nUpgrade nodejs-develUpgrade npmUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs24-npmUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-packaging-bundler | Apr 22, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade nodejs22-debuginfoUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs24-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs24-docsUpgrade nodejs-npmUpgrade nodejs24-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs22-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade nodejs24-full-i18nUpgrade npmUpgrade nodejs24-develUpgrade nodejs24-npmUpgrade nodejs24 | Apr 9, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade nodejs24-develUpgrade nodejs24-debugsourceUpgrade nodejs-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs24-libsUpgrade v8-13.6-develUpgrade v8-12.4-develUpgrade nodejs24-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade npmUpgrade nodejs24-full-i18n | Apr 13, 2026 | Apr 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub