Node.js Module Undici < 6.24.0 / 7.x < 7.24.0 Multiple Vulnerabilities

critical Nessus Plugin ID 309957

Synopsis

A module in the Node.js JavaScript run-time environment is affected by multiple vulnerabilities.

Description

The nodejs module Undici detected on the host is prior to version 6.24.0 or version 7.x prior to 7.24.0. It is, therefore, affected by multiple vulnerabilities :

- A flaw exists due to allowing duplicate HTTP Content-Length headers when provided in an array with case-variant names. An unauthenticated, remote attacker can exploit this to cause denial of service or to perform HTTP request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking. (CVE-2026-1525)

- A flaw exists in the WebSocket client due to unbounded memory consumption during permessage-deflate decompression. An unauthenticated, remote attacker can exploit this, via a decompression bomb, to cause denial of service. (CVE-2026-1526)

- A flaw exists due to insufficient validation of the upgrade option in client.request(). An authenticated, remote attacker can exploit this, via CRLF injection, to inject arbitrary HTTP headers or smuggle raw data to non-HTTP services. (CVE-2026-1527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Undici version 6.24.0 / 7.24.0 or later.

Plugin Details

Severity: Critical

ID: 309957

File Name: nodejs_module_undici_mult_vuln_mar_2026.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 4/23/2026

Updated: 4/23/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-1525

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:undici:undici

Required KB Items: installed_sw/Node.js, Host/nodejs/modules/enumerated

Patch Publication Date: 3/12/2026

Vulnerability Publication Date: 3/12/2026

Reference Information

CVE: CVE-2026-1525, CVE-2026-1526, CVE-2026-1527

IAVB: 2026-B-0072

Detections

Analytics