CVE-2026-1525: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1525 is an HTTP Request Smuggling and Denial of Service vulnerability in the Node.js undici HTTP client library, caused by improper handling of duplicate Content-Length headers supplied with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Affected versions are undici < 6.24.0 and 7.0.0 ≤ undici < 7.24.0. The vulnerability was published on March 12, 2026. The GitHub Security Advisory (GHSA-2mjp-6q6p-2qxm) rates it as Moderate with a CVSS v3.1 score of 6.5, while some sources (e.g., Feedly/NVD) assign a higher score of 9.8 — the authoritative advisory score from the OpenJS Foundation CNA is 6.5 (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). When headers are passed to undici APIs (e.g., undici.request(), undici.Client) as flat arrays, the library fails to perform case-insensitive deduplication of header names. This allows a caller to supply both Content-Length and content-length as distinct entries, resulting in both being serialized into the outgoing HTTP/1.1 request. RFC 9110 Section 8.6 explicitly prohibits sending Content-Length more than once. The attack vector is network-based and requires no authentication or user interaction; however, exploitation for request smuggling requires a specific deployment topology where an intermediary (proxy, load balancer) and a backend server interpret the duplicate headers differently — one consuming the first value and the other the last (Github Advisory, CWE-444). The vulnerability was originally reported via HackerOne report #3556037.

Exploitation can result in two distinct classes of harm. First, a Denial of Service condition occurs when strict HTTP parsers (proxies or servers) reject requests containing duplicate Content-Length headers with a 400 Bad Request response, disrupting application availability. Second, and more critically, in deployments where an intermediary and a backend server interpret the conflicting headers inconsistently, an attacker can perform HTTP Request Smuggling, enabling ACL bypass, cache poisoning, or credential hijacking. Downstream IBM products incorporating undici — including IBM API Connect, Cloud Pak for Integration, QRadar Suite, App Connect Enterprise, and others — are also affected (Github Advisory, Red Hat Bugzilla).

As of the time of this report, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.019% (5th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation for request smuggling requires a specific intermediary/backend configuration mismatch, which raises the practical attack complexity beyond what the base CVSS score may suggest.

1. Identify a target application: Locate a Node.js application that uses undici.request(), undici.Client, or similar low-level undici APIs, running an affected version (< 6.24.0 or 7.0.0–7.23.x), ideally sitting behind a proxy or load balancer.
2. Confirm header handling: Verify that the application accepts user-controlled header names without case-normalization, or that headers are passed as flat arrays rather than plain objects.
3. Craft a malicious request: Construct an HTTP request that causes undici to emit two Content-Length headers with different casing and different values, e.g., by supplying ['Content-Length', '0', 'content-length', '100'] as the headers array to the undici API.
4. Exploit intermediary inconsistency (for smuggling): In a deployment where a front-end proxy uses the first Content-Length value and the backend uses the last (or vice versa), craft the body so that the "extra" bytes are interpreted by the backend as the beginning of a second, attacker-controlled HTTP request.
5. Achieve objective: Depending on the target configuration, leverage the smuggled request to bypass ACLs, poison shared caches, or capture credentials/session tokens of other users whose requests are processed by the same backend connection (Github Advisory, CWE-444).

• Network: Outbound HTTP/1.1 requests from Node.js services containing two Content-Length headers (e.g., both Content-Length and content-length) with differing values; unexpected 400 Bad Request responses from upstream proxies or servers at elevated rates.
• Logs: Proxy or load balancer access logs showing 400 errors on requests originating from the Node.js application; backend server logs showing unexpected or out-of-sequence HTTP requests that do not correspond to client-initiated activity.
• Application Behavior: Unexplained ACL bypass events, cache serving incorrect content to users, or session/credential anomalies in applications behind a shared proxy infrastructure.

Upgrade undici to version 6.24.0 (for 6.x branch) or 7.24.0 (for 7.x branch), which fix the duplicate header serialization issue. If immediate upgrade is not possible, apply the following workarounds: (1) pass headers as a plain JavaScript object ({ 'content-length': '123' }) rather than a flat array, which naturally deduplicates by key; (2) normalize all header names to lowercase and reject or deduplicate any Content-Length entries before passing them to undici; (3) sanitize user-controlled input to prevent injection of duplicate or case-variant header names. Red Hat has issued multiple errata (RHSA-2026:7080, 7123, 7302, 7350, 7670, 7675, 7983, and others) addressing this issue across RHEL 8, 9, and 10 (Github Advisory, Red Hat Bugzilla).

The vulnerability was published by maintainer mcollina under the OpenJS Foundation CNA and reviewed by UlisesGascon. Red Hat tracked the issue as medium severity and issued numerous errata across RHEL 8, 9, and 10 within weeks of disclosure. IBM issued advisories for a broad range of affected products including API Connect, Cloud Pak for Integration, QRadar Suite, App Connect Enterprise, and watsonx Orchestrate. No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability database aggregation (Github Advisory, Red Hat Bugzilla).