Impact
When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via request(), stream(), pipeline(), or dispatch()) with a .type derived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.
The vulnerable branch in lib/dispatcher/client-h1.js pushes body.type directly into the outgoing headers with no validation, while every other header path in undici goes through isValidHeaderValue():
} else if (util.isBlobLike(body) && request.contentType == null && body.type) {
headers.push('content-type', body.type) // bypasses isValidHeaderValue()
}The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled .type. Native Blob is safe because its constructor strips CRLF from .type. fetch() is unaffected because it validates via the Headers class. Ecosystem consumers that build duck-typed blob shapes from user input include form-data-encoder, formdata-polyfill, and formdata-node.
Same defect class as CVE-2022-35948 (explicit content-type sink, fixed in undici 5.8.2) and CVE-2026-1527 (upgrade option sink, fixed in 6.24.0 / 7.24.0), both closed by adding isValidHeaderValue() on their respective sinks. This branch was missed.
Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
Workarounds
- Set an explicit, validated
content-type header on the request options (skips the vulnerable branch).
- Use a native
Blob (or fetch-blob) instead of a hand-rolled duck-typed object.
- Reject control characters in the MIME type before assigning it to
.type.
- Use
fetch() instead of the non-fetch APIs.
References
mcollina Reporter
UlisesGascon Remediation reviewer
Impact
When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via
request(),stream(),pipeline(), ordispatch()) with a.typederived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.The vulnerable branch in
lib/dispatcher/client-h1.jspushesbody.typedirectly into the outgoing headers with no validation, while every other header path in undici goes throughisValidHeaderValue():The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled
.type. NativeBlobis safe because its constructor strips CRLF from.type.fetch()is unaffected because it validates via theHeadersclass. Ecosystem consumers that build duck-typed blob shapes from user input includeform-data-encoder,formdata-polyfill, andformdata-node.Same defect class as
CVE-2022-35948(explicitcontent-typesink, fixed in undici 5.8.2) andCVE-2026-1527(upgradeoption sink, fixed in 6.24.0 / 7.24.0), both closed by addingisValidHeaderValue()on their respective sinks. This branch was missed.Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
Workarounds
content-typeheader on the request options (skips the vulnerable branch).Blob(orfetch-blob) instead of a hand-rolled duck-typed object..type.fetch()instead of the non-fetchAPIs.References