USY-2026-0116 · HTTP request smuggling · score 8.2

Request smuggling via unvalidated header names

Header names containing control characters are forwarded verbatim, allowing a request to be split at an intermediary that parses them differently.

SyntheticThis advisory is invented for the demonstration. undici is a real package; nothing described here has been reported against it.

Affected package

undici

Affected releases

4 from 6.0.0

Fixed in

6.19.2

Published

2 May 2026

Blast radius

9 of 12 · nearest 2

Auth GatewayPlatform2 hops · 2 affected releases

Application
Auth Gateway
Hop 1declared · 6.2.4
helmet6.2.4
Faulttransitive · ^6.0.2
undici6.0.2
Affected. Fixed in 6.19.2.

Notification RelayPlatform2 hops

Not reached · 3Data Exporter, Fraud Scoring, Reporting Pipeline

Where to cut

node-fetch carries 4 of 9

Drop the application at one end and the flawed release at the other, and count what is left in the middle. node-fetch sits on 4 of the 9 shortest paths, which makes it the cheapest single place to break the chain.

node-fetch 3.6.7on 4 of 9 paths

Admin Console · Ledger API · Mobile BFF · Storefront Web

bcrypt 3.2.0on 2 of 9 paths

Docs Site · Inventory Sync

d3 1.5.6on 1 of 9 paths

Checkout Service

helmet 6.2.4on 1 of 9 paths

Auth Gateway

kafkajs 6.0.5on 1 of 9 paths

Mobile BFF

luxon 1.3.4

Affected releases

6.0.615 Jun 2023

6.0.52 Nov 2022

6.0.29 Jun 2022

6.0.010 Nov 2021

Package role

HTTP client core9.6M downloads/wk

Who can publish it

1 account

Ines Oduyaines-oduyaNo 2FA

One account can publish this package. Whoever holds it can reach everything downstream of it, with or without an advisory.