Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
* Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization
Potential consequences:
* Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-docsUpgrade v8-13.6-develUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-devel | Apr 16, 2026 | Apr 8, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-docsUpgrade nodejs20Upgrade nodejs22-libsUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-develUpgrade nodejs24-full-i18nUpgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejs20-libsUpgrade nodejs20-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs24-libsUpgrade nodejs20-docsUpgrade nodejs22-npmUpgrade nodejs22-debugsourceUpgrade nodejs24-npmUpgrade nodejs20-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs22-full-i18nUpgrade nodejs22Upgrade v8-12.4-develUpgrade nodejs20-npmUpgrade nodejs22-docsUpgrade nodejs24-debugsourceUpgrade v8-11.3-develUpgrade nodejs24Upgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs22-debuginfo | Apr 7, 2026 | Mar 12, 2026 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-npmUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs24-develUpgrade v8-13.6-develUpgrade npmUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs24-npm | Apr 22, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs24Upgrade nodejs24-full-i18nUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-develUpgrade nodejs22-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs24-libsUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade nodejs-docsUpgrade nodejs24-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs22-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs24-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packaging | Apr 9, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade nodejs24Upgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade npmUpgrade v8-12.4-develUpgrade nodejs-libs-debuginfoUpgrade v8-13.6-develUpgrade nodejs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24-libsUpgrade nodejs-develUpgrade nodejs24-debugsourceUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs24-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs22-debuginfo | Apr 13, 2026 | Apr 10, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub