Read the docs
TI-2026-01215 Aliases CVE-2026-1525GHSA-2mjp-6q6p-2qxm

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Priority HIGH 81CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential consequences: * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request) * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Fix Partial undici (undici): 6.24.0: 7.24.0undici (npm): 6.24.0, 7.24.0Red Hat: 14 advisoriesRed Hat: 11 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSundici< 6.24.0; 7.0.0 < 7.24.06.24.0: 7.24.0Patch availableCNA
—undici (npm)before 6.24.06.24.0Patch availableGHSA-2mjp-6q6p-2qxm
—undici (npm)7.0.0 to before 7.24.07.24.0Patch availableGHSA-2mjp-6q6p-2qxm
  • undici VendorNodeJS Affected < 6.24.0; 7.0.0 < 7.24.0 Fixed in 6.24.0: 7.24.0 Patch available CNA
  • undici (npm) Vendor— Affected before 6.24.0 Fixed in 6.24.0 Patch available GHSA-2mjp-6q6p-2qxm
  • undici (npm) Vendor— Affected 7.0.0 to before 7.24.0 Fixed in 7.24.0 Patch available GHSA-2mjp-6q6p-2qxm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*before 6.24.0; 7.0.0 to before 7.24.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions before 6.24.0; 7.0.0 to before 7.24.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA undici (undici) Fixed in 6.24.0: 7.24.0
  • Fix · GHSA-2mjp-6q6p-2qxm undici (npm) Fixed in 6.24.0 Advisory →
  • Fix · GHSA-2mjp-6q6p-2qxm undici (npm) Fixed in 7.24.0 Advisory →

Red Hat 14 advisories

  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:56431 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
Show 11 more Red Hat advisories
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:7983 Released 2026-04-14 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.s390x::nodejs:22 +28
  • RHSA-2026:7670 Released 2026-04-13 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.s390x::nodejs:24 +25
  • RHSA-2026:7675 Released 2026-04-13 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.14.1-2.el10_1, nodejs24-devel-1:24.14.1-2.el10_1, nodejs24-docs-1:24.14.1-2.el10_1 +3
  • RHSA-2026:7350 Released 2026-04-09 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.s390x::nodejs:24 +25
  • RHSA-2026:7310 Released 2026-04-09 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.22.2-2.el10_0, nodejs-devel-1:22.22.2-2.el10_0, nodejs-docs-1:22.22.2-2.el10_0 +4
  • RHSA-2026:7302 Released 2026-04-09 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22 +28
  • RHSA-2026:7123 Released 2026-04-08 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22 +28
  • RHSA-2026:7080 Released 2026-04-08 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.22.2-1.el10_1, nodejs-devel-1:22.22.2-1.el10_1, nodejs-docs-1:22.22.2-1.el10_1 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:7080, RHSA-2026:7675
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:7123, RHSA-2026:7670
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:7302, RHSA-2026:7350
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:7310
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:7983
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:56431
Not affected: 9 products
  • Cryostat 4 on RHEL 9
  • OpenShift Pipelines
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Openshift Data Foundation 4.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1525
  2. 2026-10-03 Alias added: GHSA-2mjp-6q6p-2qxm
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 3

Other 4

  • TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
  • TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
  • TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
  • TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
  • TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
  • TI-2024-20007 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect CVSS 3.1LOW 3.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences