Vulnerability in Undici

CVE-2026-1525

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length va…

Vulnerability class: HTTP Request Smuggling

EPSS: 0.000 (5.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

Affected products

  • Undici — versions < 6.24.0; 7.0.0 < 7.24.0, 6.24.0: 7.24.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-1525?
CVE-2026-1525 is a medium-severity vulnerability in Undici, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 6.5/10. Published 2026-03-12.
How severe is CVE-2026-1525?
Medium severity. CVSS v3 base score is 6.5 out of 10.